njrat | 2e15758b43bd03a317325eeb94461dd3aa146c9db3e6c31b8e9dda441f1ba4b3

General

Target

508dbdf33362da23088dc438a6685681.exe
Size

31KB
MD5

508dbdf33362da23088dc438a6685681
SHA1

33ecad58c258c5cd896027811c6fa0f42564255b
SHA256

2e15758b43bd03a317325eeb94461dd3aa146c9db3e6c31b8e9dda441f1ba4b3
SHA512

9d643c60e94ec113b78d5dccef135d94b5dc6d5e8896aa44f7997ba8ee8150a5a3999d580fdd4f6e7fcf6e90195859022e4237fbcb073b32d8510fef4c723c6b

Score

10^/10

njrat evasion trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

508dbdf33362da23088dc438a6685681.exe

description	pid	process
Token: SeDebugPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe
Token: 33	1992	508dbdf33362da23088dc438a6685681.exe
Token: SeIncBasePriorityPrivilege	1992	508dbdf33362da23088dc438a6685681.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

508dbdf33362da23088dc438a6685681.exe

description	pid	process	target process
PID 1992 wrote to memory of 1544	1992	508dbdf33362da23088dc438a6685681.exe	netsh.exe
PID 1992 wrote to memory of 1544	1992	508dbdf33362da23088dc438a6685681.exe	netsh.exe
PID 1992 wrote to memory of 1544	1992	508dbdf33362da23088dc438a6685681.exe	netsh.exe
PID 1992 wrote to memory of 1544	1992	508dbdf33362da23088dc438a6685681.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\508dbdf33362da23088dc438a6685681.exe
"C:\Users\Admin\AppData\Local\Temp\508dbdf33362da23088dc438a6685681.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\508dbdf33362da23088dc438a6685681.exe" "508dbdf33362da23088dc438a6685681.exe" ENABLE
2⤵
PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-57-0x0000000000000000-mapping.dmp

Download
memory/1992-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing