njrat | c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191

General

Target

c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exe
Size

126KB
MD5

9ed1a098f59de1901780c6eb187aeac8
SHA1

0cd5d65e05043b349066c431bacf84302d96cd51
SHA256

c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191
SHA512

44280abf5e1bb9964f53c2efdf71806cfa0223939f69b6e1c10d8eccbcfaf111a412d70f8c0dc175f9f2b0e34eadafac5307554155f1e52d2eebec44716b4083

Score

10^/10

njrat @ west - hacking k.s.a @ persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

@ WeSt - HaCkInG K.S.A @

C2

w187.ddns.net:22

Mutex

Intel HD Graphics Drivers for Windows(R)

Attributes

reg_key
Intel HD Graphics Drivers for Windows(R)
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

pid process

884 Intel HD Graphics Drivers for Windows(R).exe
1336 Intel HD Graphics Drivers for Windows(R).exe

pid	process
884	Intel HD Graphics Drivers for Windows(R).exe
1336	Intel HD Graphics Drivers for Windows(R).exe

Drops startup file 4 IoCs

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk	Intel HD Graphics Drivers for Windows(R).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk	Intel HD Graphics Drivers for Windows(R).exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R) = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R) = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Intel HD Graphics Drivers for Windows(R).exe"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exeIntel HD Graphics Drivers for Windows(R).exe

description	pid	process
Token: SeDebugPrivilege	652	c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exe
Token: 33	652	c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exe
Token: SeIncBasePriorityPrivilege	652	c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exe
Token: SeDebugPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	1336	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	1336	Intel HD Graphics Drivers for Windows(R).exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exeIntel HD Graphics Drivers for Windows(R).exe

description	pid	process	target process
PID 652 wrote to memory of 884	652	c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 652 wrote to memory of 884	652	c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 652 wrote to memory of 884	652	c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 884 wrote to memory of 1336	884	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 884 wrote to memory of 1336	884	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 884 wrote to memory of 1336	884	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 884 wrote to memory of 1476	884	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe
PID 884 wrote to memory of 1476	884	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe
PID 884 wrote to memory of 1476	884	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1476 attrib.exe

pid	process
1476	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exe
"C:\Users\Admin\AppData\Local\Temp\c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652

C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
"C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:884

C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
"C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe"
3⤵
- Views/modifies file attributes
PID:1476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk
MD5
75d3ceb076c85ec307e587a7cef7b69e

SHA1
a3acf2cf7ee1f316cc91c25e76b09f364215538c

SHA256
695e75ecfe3a476da0a1dc0335a6dd46a3e8ecefbffbeaa2e738b3ec3f3613ae

SHA512
7747872fde5ace1a27c0169ea2e8fb6090e54eaeb84b2451b41e10ccfab66b7613b8fe6cac2d25b1c845136cc8fd9d714b65dd4b6e814e84c2ab3f3fd3babc80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Intel HD Graphics Drivers for Windows(R).lnk
MD5
252b37f9414f08a1e0a4b1936ee86215

SHA1
0297c7b4c3541ea2ec73de1a811ef5b79b26968f

SHA256
d60f697e7bcb8b6089ca2b274aa33a66a5543649c2558b2c0b2b0b41f2fc5975

SHA512
f42a369f284be941c22730bb1f75e7845540b335174b20260af90746ff11fbad4f6390946bf2fb98cce7f5f8ce7976c52c4eed15b867466add5ed4133d8c98d2

Download Submit
memory/652-118-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/652-117-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/652-116-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/652-114-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/884-119-0x0000000000000000-mapping.dmp

Download
memory/884-122-0x0000000000C00000-0x0000000000D4A000-memory.dmp

Filesize
1.3MB

Download
memory/1336-123-0x0000000000000000-mapping.dmp

Download
memory/1336-129-0x00000000030E0000-0x00000000030E1000-memory.dmp

Filesize
4KB

Download
memory/1476-126-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads