njrat | e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a

General

Target

e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe
Size

385KB
MD5

22efb002ff6995db833e92bc0e151613
SHA1

fe78c82bf566f4c54b32474917b13b66ef1c11ff
SHA256

e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a
SHA512

7218abb399f75d81bf0eb5bd41f62eb5ba648632ea49818598791ccdff002fb4770214c0efd08517faa3d622ac8ababbeb1e50e5768787f2988c2eeb9a5c3202

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

almammory.hopto.org:5552

Mutex

afc92bf1571988bf5da2e394256896ce

Attributes

reg_key
afc92bf1571988bf5da2e394256896ce
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1824 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1824 AcroRd32.exe
1824 AcroRd32.exe
1824 AcroRd32.exe

pid	process
1824	AcroRd32.exe

pid	process
1824	AcroRd32.exe
1824	AcroRd32.exe
1824	AcroRd32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exerundll32.exe

description	pid	process	target process
PID 1304 wrote to memory of 1664	1304	e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe	rundll32.exe
PID 1304 wrote to memory of 1664	1304	e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe	rundll32.exe
PID 1304 wrote to memory of 1664	1304	e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe	rundll32.exe
PID 1304 wrote to memory of 1664	1304	e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe	rundll32.exe
PID 1304 wrote to memory of 1664	1304	e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe	rundll32.exe
PID 1304 wrote to memory of 1664	1304	e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe	rundll32.exe
PID 1304 wrote to memory of 1664	1304	e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe	rundll32.exe
PID 1664 wrote to memory of 1824	1664	rundll32.exe	AcroRd32.exe
PID 1664 wrote to memory of 1824	1664	rundll32.exe	AcroRd32.exe
PID 1664 wrote to memory of 1824	1664	rundll32.exe	AcroRd32.exe
PID 1664 wrote to memory of 1824	1664	rundll32.exe	AcroRd32.exe

C:\Users\Admin\AppData\Local\Temp\e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe
"C:\Users\Admin\AppData\Local\Temp\e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\server
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1664

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\server"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server
MD5
22efb002ff6995db833e92bc0e151613

SHA1
fe78c82bf566f4c54b32474917b13b66ef1c11ff

SHA256
e64dc8b80b5d447b520f557781acb0b3d539c92e6919de4b376ef1cca9af953a

SHA512
7218abb399f75d81bf0eb5bd41f62eb5ba648632ea49818598791ccdff002fb4770214c0efd08517faa3d622ac8ababbeb1e50e5768787f2988c2eeb9a5c3202

Download Submit
memory/1304-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1304-61-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/1664-62-0x0000000000000000-mapping.dmp

Download
memory/1824-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing