njrat | 48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

General

Target

48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe
Size

3.7MB
MD5

1856b06c2392d0a5e7b73f4e98e3a840
SHA1

23a8cf21174428413fac5fe98b02035b9a8d6857
SHA256

48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41
SHA512

a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

Score

10^/10

njrat dot@ kg persistence suricata trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

DoT@ kg

C2

2.tcp.ngrok.io:19365

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Executes dropped EXE 4 IoCs

Processes:

svchost.exeServer.exeServer.exeServer.exe

pid process

1528 svchost.exe
1004 Server.exe
1356 Server.exe
892 Server.exe

pid	process
1528	svchost.exe
1004	Server.exe
1356	Server.exe
892	Server.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	svchost.exe

Loads dropped DLL 1 IoCs

Processes:

48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe

pid process

1988 48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe

pid	process
1988	48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1760 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svchost.exe

pid process

1528 svchost.exe

pid	process
1760	schtasks.exe

pid	process
1528	svchost.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe
Token: 33	1528	svchost.exe
Token: SeIncBasePriorityPrivilege	1528	svchost.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exesvchost.exetaskeng.exe

description	pid	process	target process
PID 1988 wrote to memory of 1528	1988	48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe	svchost.exe
PID 1988 wrote to memory of 1528	1988	48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe	svchost.exe
PID 1988 wrote to memory of 1528	1988	48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe	svchost.exe
PID 1988 wrote to memory of 1528	1988	48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe	svchost.exe
PID 1528 wrote to memory of 1760	1528	svchost.exe	schtasks.exe
PID 1528 wrote to memory of 1760	1528	svchost.exe	schtasks.exe
PID 1528 wrote to memory of 1760	1528	svchost.exe	schtasks.exe
PID 1528 wrote to memory of 1760	1528	svchost.exe	schtasks.exe
PID 1044 wrote to memory of 1004	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 1004	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 1004	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 1004	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 1356	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 1356	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 1356	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 1356	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 892	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 892	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 892	1044	taskeng.exe	Server.exe
PID 1044 wrote to memory of 892	1044	taskeng.exe	Server.exe

C:\Users\Admin\AppData\Local\Temp\48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe
"C:\Users\Admin\AppData\Local\Temp\48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
3⤵
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\taskeng.exe
taskeng.exe {176667EE-99DC-4264-9B77-459A45215FE0} S-1-5-21-103686315-404690609-2047157615-1000:EDWYFHKN\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:1004

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:1356

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server.exe
MD5
1856b06c2392d0a5e7b73f4e98e3a840

SHA1
23a8cf21174428413fac5fe98b02035b9a8d6857

SHA256
48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

SHA512
a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
MD5
1856b06c2392d0a5e7b73f4e98e3a840

SHA1
23a8cf21174428413fac5fe98b02035b9a8d6857

SHA256
48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

SHA512
a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
MD5
1856b06c2392d0a5e7b73f4e98e3a840

SHA1
23a8cf21174428413fac5fe98b02035b9a8d6857

SHA256
48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

SHA512
a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
MD5
1856b06c2392d0a5e7b73f4e98e3a840

SHA1
23a8cf21174428413fac5fe98b02035b9a8d6857

SHA256
48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

SHA512
a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
MD5
1856b06c2392d0a5e7b73f4e98e3a840

SHA1
23a8cf21174428413fac5fe98b02035b9a8d6857

SHA256
48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

SHA512
a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
MD5
1856b06c2392d0a5e7b73f4e98e3a840

SHA1
23a8cf21174428413fac5fe98b02035b9a8d6857

SHA256
48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

SHA512
a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe
MD5
1856b06c2392d0a5e7b73f4e98e3a840

SHA1
23a8cf21174428413fac5fe98b02035b9a8d6857

SHA256
48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

SHA512
a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

Download Submit
memory/892-76-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/892-73-0x0000000000000000-mapping.dmp

Download
memory/1004-68-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1004-65-0x0000000000000000-mapping.dmp

Download
memory/1356-72-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/1356-69-0x0000000000000000-mapping.dmp

Download
memory/1528-58-0x0000000000000000-mapping.dmp

Download
memory/1528-62-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/1760-63-0x0000000000000000-mapping.dmp

Download
memory/1988-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1988-56-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads