njrat | c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f

General

Target

c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
Size

125KB
MD5

3fbf4474b23237150d9018329c00a1f1
SHA1

182410f52162e2c65b3491adfdc80e2bdd05fe50
SHA256

c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f
SHA512

65293c7d99abdb7fc9539f9a1a1640ccfb0a11e06f9949639b7592de2445f6144652666fefd8eb2570207833df85041a754af85fd077e4f0a92b0b33a74ee907

Score

10^/10

njrat @ west - hacking k.s.a @ persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

@ WeSt - HaCkInG K.S.A @

C2

w187.ddns.net:22

Mutex

Intel HD Graphics Drivers for Windows(R)

Attributes

reg_key
Intel HD Graphics Drivers for Windows(R)
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

pid process

632 Intel HD Graphics Drivers for Windows(R).exe
520 Intel HD Graphics Drivers for Windows(R).exe

pid	process
632	Intel HD Graphics Drivers for Windows(R).exe
520	Intel HD Graphics Drivers for Windows(R).exe

Drops startup file 4 IoCs

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk	Intel HD Graphics Drivers for Windows(R).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk	Intel HD Graphics Drivers for Windows(R).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Intel HD Graphics Drivers for Windows(R).exe"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R) = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R) = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exeIntel HD Graphics Drivers for Windows(R).exe

description	pid	process
Token: SeDebugPrivilege	1832	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
Token: 33	1832	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
Token: SeIncBasePriorityPrivilege	1832	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
Token: SeDebugPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	520	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	520	Intel HD Graphics Drivers for Windows(R).exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exeIntel HD Graphics Drivers for Windows(R).exe

description	pid	process	target process
PID 1832 wrote to memory of 632	1832	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 1832 wrote to memory of 632	1832	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 1832 wrote to memory of 632	1832	c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 632 wrote to memory of 520	632	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 632 wrote to memory of 520	632	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 632 wrote to memory of 520	632	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 632 wrote to memory of 828	632	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe
PID 632 wrote to memory of 828	632	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe
PID 632 wrote to memory of 828	632	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

828 attrib.exe

pid	process
828	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe
"C:\Users\Admin\AppData\Local\Temp\c3ecb60634ee3e18fb05e1ebb99ceeb681719627c85eb5a5aa662242adb0b67f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
"C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
"C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe"
3⤵
- Views/modifies file attributes
PID:828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk
MD5
75d3ceb076c85ec307e587a7cef7b69e

SHA1
a3acf2cf7ee1f316cc91c25e76b09f364215538c

SHA256
695e75ecfe3a476da0a1dc0335a6dd46a3e8ecefbffbeaa2e738b3ec3f3613ae

SHA512
7747872fde5ace1a27c0169ea2e8fb6090e54eaeb84b2451b41e10ccfab66b7613b8fe6cac2d25b1c845136cc8fd9d714b65dd4b6e814e84c2ab3f3fd3babc80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Intel HD Graphics Drivers for Windows(R).lnk
MD5
252b37f9414f08a1e0a4b1936ee86215

SHA1
0297c7b4c3541ea2ec73de1a811ef5b79b26968f

SHA256
d60f697e7bcb8b6089ca2b274aa33a66a5543649c2558b2c0b2b0b41f2fc5975

SHA512
f42a369f284be941c22730bb1f75e7845540b335174b20260af90746ff11fbad4f6390946bf2fb98cce7f5f8ce7976c52c4eed15b867466add5ed4133d8c98d2

Download Submit
memory/520-123-0x0000000000000000-mapping.dmp

Download
memory/520-129-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/632-119-0x0000000000000000-mapping.dmp

Download
memory/632-122-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/828-126-0x0000000000000000-mapping.dmp

Download
memory/1832-118-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/1832-117-0x0000000005CC0000-0x0000000005CC1000-memory.dmp

Filesize
4KB

Download
memory/1832-116-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/1832-114-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads