njrat | c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f

General

Target

c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
Size

125KB
MD5

3fbf4474b23237150d9018329c00a1f1
SHA1

182410f52162e2c65b3491adfdc80e2bdd05fe50
SHA256

c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f
SHA512

65293c7d99abdb7fc9539f9a1a1640ccfb0a11e06f9949639b7592de2445f6144652666fefd8eb2570207833df85041a754af85fd077e4f0a92b0b33a74ee907

Score

10^/10

njrat @ west - hacking k.s.a @ persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

@ WeSt - HaCkInG K.S.A @

C2

w187.ddns.net:22

Mutex

Intel HD Graphics Drivers for Windows(R)

Attributes

reg_key
Intel HD Graphics Drivers for Windows(R)
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

pid process

2332 Intel HD Graphics Drivers for Windows(R).exe
3948 Intel HD Graphics Drivers for Windows(R).exe

pid	process
2332	Intel HD Graphics Drivers for Windows(R).exe
3948	Intel HD Graphics Drivers for Windows(R).exe

Drops startup file 4 IoCs

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk	Intel HD Graphics Drivers for Windows(R).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk	Intel HD Graphics Drivers for Windows(R).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R) = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Intel HD Graphics Drivers for Windows(R).exe"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R) = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exeIntel HD Graphics Drivers for Windows(R).exe

description	pid	process
Token: SeDebugPrivilege	1860	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
Token: 33	1860	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
Token: SeIncBasePriorityPrivilege	1860	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
Token: SeDebugPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	3948	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	3948	Intel HD Graphics Drivers for Windows(R).exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exeIntel HD Graphics Drivers for Windows(R).exe

description	pid	process	target process
PID 1860 wrote to memory of 2332	1860	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 1860 wrote to memory of 2332	1860	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 1860 wrote to memory of 2332	1860	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 2332 wrote to memory of 3948	2332	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 2332 wrote to memory of 3948	2332	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 2332 wrote to memory of 3948	2332	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 2332 wrote to memory of 2256	2332	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe
PID 2332 wrote to memory of 2256	2332	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe
PID 2332 wrote to memory of 2256	2332	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2256 attrib.exe

pid	process
2256	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
"C:\Users\Admin\AppData\Local\Temp\c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860

C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
"C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2332

C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
"C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe"
3⤵
- Views/modifies file attributes
PID:2256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk
MD5
093b7280eb11ec3e0f865b5bd4c3e37e

SHA1
85ffd8ea5a32548a65c636621e0164946db8006f

SHA256
26f8e3b6a0a644394df617dfb3397c34093ba3a9aada5f6b2ff17226cb799167

SHA512
8fce0a825fbad833ec6bb4bfeb67ee893f28943aeac871163ccf10d5802929ceaad0221a86a3a9bb734cebbfdffe1d6b9b05c913b573fb082f138851d93cdf80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Intel HD Graphics Drivers for Windows(R).lnk
MD5
804a57fef1fb94a736eacfbab590d616

SHA1
928a0262876c6f9b04e0f271f3d39b74c02567ba

SHA256
4daa4a8ae2f66ad83a3372d8a791788d15bee61adfd5a427e09e0662a0a92a85

SHA512
1c0ecb05c8b10ba6f05bf256a3bf00deab1000d9002b7a928cda0ee0f0dd9b778231283c4a2883f9993817e65c8ddd492903c65366b129e3beda44c2acc0592d

Download Submit
memory/1860-119-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/1860-118-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/1860-117-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/1860-115-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2256-127-0x0000000000000000-mapping.dmp

Download
memory/2332-120-0x0000000000000000-mapping.dmp

Download
memory/2332-123-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/3948-124-0x0000000000000000-mapping.dmp

Download
memory/3948-130-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads