njrat | 11c0380a1944b579293ffb34e61b3dfdeaeebd712a5fcf1b2f377b50c5e49113

General

Target

b02448be6d957bc18ed6a1b97038ed1a.exe
Size

353KB
MD5

b02448be6d957bc18ed6a1b97038ed1a
SHA1

33e8945ccc4f088a33977e75ec791ba6591880b4
SHA256

11c0380a1944b579293ffb34e61b3dfdeaeebd712a5fcf1b2f377b50c5e49113
SHA512

9fef4b91950c584e2390fa536084c01ea4f1ec9f397b26e2f98036425d261135c3d91b512e88d6328bcfd8ad1e0f42eabbf54f8b090af95ee1671b3bc9899a09

Score

10^/10

njrat hacked trojan vmprotect

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

6.tcp.ngrok.io:19425

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

build.exe

pid process

2676 build.exe

pid	process
2676	build.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/2488-115-0x0000000000910000-0x0000000000911000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

build.exe

pid process

2676 build.exe

pid	process
2676	build.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

build.exe

description	pid	process
Token: SeDebugPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe
Token: 33	2676	build.exe
Token: SeIncBasePriorityPrivilege	2676	build.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b02448be6d957bc18ed6a1b97038ed1a.exe

description	pid	process	target process
PID 2488 wrote to memory of 2676	2488	b02448be6d957bc18ed6a1b97038ed1a.exe	build.exe
PID 2488 wrote to memory of 2676	2488	b02448be6d957bc18ed6a1b97038ed1a.exe	build.exe
PID 2488 wrote to memory of 2676	2488	b02448be6d957bc18ed6a1b97038ed1a.exe	build.exe

C:\Users\Admin\AppData\Local\Temp\b02448be6d957bc18ed6a1b97038ed1a.exe
"C:\Users\Admin\AppData\Local\Temp\b02448be6d957bc18ed6a1b97038ed1a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Users\Admin\AppData\Local\build.exe
"C:\Users\Admin\AppData\Local\build.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\build.exe
MD5
f8ceb3cdb0025d4abf77b1a14e9da8eb

SHA1
01c44b7443e02b2ad6541c1e6bbc1c9531ebc3a3

SHA256
374c7e0f09e5e6e5f79bb784df2d6704bd0a1d5d108db97977cd85d49507ccb0

SHA512
bc74f673410c45609756e9c6332dc6021b61b1b97f6d98495a7651c7ccd0985bea6b4108e0363d8947205b27b44fbe1591df8c6b205f5b976ac186b4156efcf6

Download Submit
C:\Users\Admin\AppData\Local\build.exe
MD5
f8ceb3cdb0025d4abf77b1a14e9da8eb

SHA1
01c44b7443e02b2ad6541c1e6bbc1c9531ebc3a3

SHA256
374c7e0f09e5e6e5f79bb784df2d6704bd0a1d5d108db97977cd85d49507ccb0

SHA512
bc74f673410c45609756e9c6332dc6021b61b1b97f6d98495a7651c7ccd0985bea6b4108e0363d8947205b27b44fbe1591df8c6b205f5b976ac186b4156efcf6

Download Submit
memory/2488-115-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2676-118-0x0000000000000000-mapping.dmp

Download
memory/2676-121-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2676-123-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/2676-124-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/2676-125-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/2676-126-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/2676-127-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/2676-128-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/2676-129-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads