njrat | 8a2e1a0ade05db6ef7fdc307b058119e7d84c26b7a75495a4348e310d67f15e7

General

Target

834e38185fb19b1adf58cc82aaf73e1e.exe
Size

399KB
MD5

834e38185fb19b1adf58cc82aaf73e1e
SHA1

2a3bca9b936093f82a1be92737012e683a863a6a
SHA256

8a2e1a0ade05db6ef7fdc307b058119e7d84c26b7a75495a4348e310d67f15e7
SHA512

4fe755a20fcbf6ac5c1f4993489a9c00306908f4497d11d1d260aad6bf26dbb7cd7b86e14d0d15f2546267df8cd19b2765405a1ee446d8bd316aa11201f1e7c9

Score

10^/10

njrat ------(send)------trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

------(Send)------

C2

new.libya2020.com.ly:2020

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 1 IoCs

Processes:

834e38185fb19b1adf58cc82aaf73e1e.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	834e38185fb19b1adf58cc82aaf73e1e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

834e38185fb19b1adf58cc82aaf73e1e.exe

description pid process target process

PID 2672 set thread context of 4092 2672 834e38185fb19b1adf58cc82aaf73e1e.exe 834e38185fb19b1adf58cc82aaf73e1e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2136 schtasks.exe

description	pid	process	target process
PID 2672 set thread context of 4092	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe

pid	process
2136	schtasks.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

834e38185fb19b1adf58cc82aaf73e1e.exe

description	pid	process
Token: SeDebugPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: 33	4092	834e38185fb19b1adf58cc82aaf73e1e.exe
Token: SeIncBasePriorityPrivilege	4092	834e38185fb19b1adf58cc82aaf73e1e.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

834e38185fb19b1adf58cc82aaf73e1e.exe

description	pid	process	target process
PID 2672 wrote to memory of 2136	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	schtasks.exe
PID 2672 wrote to memory of 2136	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	schtasks.exe
PID 2672 wrote to memory of 2136	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	schtasks.exe
PID 2672 wrote to memory of 4092	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 2672 wrote to memory of 4092	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 2672 wrote to memory of 4092	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 2672 wrote to memory of 4092	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 2672 wrote to memory of 4092	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 2672 wrote to memory of 4092	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 2672 wrote to memory of 4092	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe
PID 2672 wrote to memory of 4092	2672	834e38185fb19b1adf58cc82aaf73e1e.exe	834e38185fb19b1adf58cc82aaf73e1e.exe

C:\Users\Admin\AppData\Local\Temp\834e38185fb19b1adf58cc82aaf73e1e.exe
"C:\Users\Admin\AppData\Local\Temp\834e38185fb19b1adf58cc82aaf73e1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dRjlsmRl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA489.tmp"
2⤵
- Creates scheduled task(s)
PID:2136

C:\Users\Admin\AppData\Local\Temp\834e38185fb19b1adf58cc82aaf73e1e.exe
"C:\Users\Admin\AppData\Local\Temp\834e38185fb19b1adf58cc82aaf73e1e.exe"
2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:4092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-124-0x0000000000000000-mapping.dmp

Download
memory/2672-122-0x0000000009520000-0x0000000009521000-memory.dmp

Filesize
4KB

Download
memory/2672-118-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/2672-119-0x00000000058E0000-0x0000000005DDE000-memory.dmp

Filesize
5.0MB

Download
memory/2672-120-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/2672-121-0x0000000005DC0000-0x0000000005DC7000-memory.dmp

Filesize
28KB

Download
memory/2672-115-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/2672-123-0x0000000009480000-0x00000000094A9000-memory.dmp

Filesize
164KB

Download
memory/2672-117-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

Filesize
4KB

Download
memory/4092-125-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4092-126-0x000000000040839E-mapping.dmp

Download
memory/4092-131-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/4092-134-0x0000000005830000-0x0000000005831000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads