njrat | 280eafd06a8484a10980170c2ff14f344bdae364e52c6680068d2f866175f746

General

Target

BladaBindi_1.exe
Size

108KB
MD5

d8fe97c45c907fc6dac792590fa11f68
SHA1

b51408881f22a20bb8c1a1a1623e91aff44d15e8
SHA256

280eafd06a8484a10980170c2ff14f344bdae364e52c6680068d2f866175f746
SHA512

ab8cdc9cf24b46ff664d96d4de1b430fb6a16e14b0cd944bbe7f5e4c323b7a120689422bddb7c071d1a52dca8e80cc2dde989cdd693a61b1e27b76ccfa291bdf

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

hostr.exehostr.exe

pid process

3292 hostr.exe
3484 hostr.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
3292	hostr.exe
3484	hostr.exe

Drops startup file 2 IoCs

Processes:

hostr.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ec83b2d446200dcd0392570446c898a3.exe	hostr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ec83b2d446200dcd0392570446c898a3.exe	hostr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hostr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\ec83b2d446200dcd0392570446c898a3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hostr.exe\" .."	hostr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ec83b2d446200dcd0392570446c898a3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hostr.exe\" .."	hostr.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

BladaBindi_1.exehostr.exe

description	pid	process	target process
PID 3688 set thread context of 772	3688	BladaBindi_1.exe	BladaBindi_1.exe
PID 3292 set thread context of 3484	3292	hostr.exe	hostr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

hostr.exe

pid	process
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe
3484	hostr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

BladaBindi_1.exehostr.exehostr.exe

description pid process

Token: SeDebugPrivilege 3688 BladaBindi_1.exe
Token: SeDebugPrivilege 3292 hostr.exe
Token: SeDebugPrivilege 3484 hostr.exe

description	pid	process
Token: SeDebugPrivilege	3688	BladaBindi_1.exe
Token: SeDebugPrivilege	3292	hostr.exe
Token: SeDebugPrivilege	3484	hostr.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

BladaBindi_1.exeBladaBindi_1.exehostr.exehostr.exe

description	pid	process	target process
PID 3688 wrote to memory of 772	3688	BladaBindi_1.exe	BladaBindi_1.exe
PID 3688 wrote to memory of 772	3688	BladaBindi_1.exe	BladaBindi_1.exe
PID 3688 wrote to memory of 772	3688	BladaBindi_1.exe	BladaBindi_1.exe
PID 3688 wrote to memory of 772	3688	BladaBindi_1.exe	BladaBindi_1.exe
PID 3688 wrote to memory of 772	3688	BladaBindi_1.exe	BladaBindi_1.exe
PID 3688 wrote to memory of 772	3688	BladaBindi_1.exe	BladaBindi_1.exe
PID 3688 wrote to memory of 772	3688	BladaBindi_1.exe	BladaBindi_1.exe
PID 3688 wrote to memory of 772	3688	BladaBindi_1.exe	BladaBindi_1.exe
PID 772 wrote to memory of 3292	772	BladaBindi_1.exe	hostr.exe
PID 772 wrote to memory of 3292	772	BladaBindi_1.exe	hostr.exe
PID 772 wrote to memory of 3292	772	BladaBindi_1.exe	hostr.exe
PID 3292 wrote to memory of 3484	3292	hostr.exe	hostr.exe
PID 3292 wrote to memory of 3484	3292	hostr.exe	hostr.exe
PID 3292 wrote to memory of 3484	3292	hostr.exe	hostr.exe
PID 3292 wrote to memory of 3484	3292	hostr.exe	hostr.exe
PID 3292 wrote to memory of 3484	3292	hostr.exe	hostr.exe
PID 3292 wrote to memory of 3484	3292	hostr.exe	hostr.exe
PID 3292 wrote to memory of 3484	3292	hostr.exe	hostr.exe
PID 3292 wrote to memory of 3484	3292	hostr.exe	hostr.exe
PID 3484 wrote to memory of 1416	3484	hostr.exe	netsh.exe
PID 3484 wrote to memory of 1416	3484	hostr.exe	netsh.exe
PID 3484 wrote to memory of 1416	3484	hostr.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\BladaBindi_1.exe
"C:\Users\Admin\AppData\Local\Temp\BladaBindi_1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688

C:\Users\Admin\AppData\Local\Temp\BladaBindi_1.exe
C:\Users\Admin\AppData\Local\Temp\BladaBindi_1.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Users\Admin\AppData\Local\Temp\hostr.exe
"C:\Users\Admin\AppData\Local\Temp\hostr.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292

C:\Users\Admin\AppData\Local\Temp\hostr.exe
C:\Users\Admin\AppData\Local\Temp\hostr.exe
4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\hostr.exe" "hostr.exe" ENABLE
5⤵
PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\BladaBindi_1.exe.log

MD5
9424b451803882d2fc76f5ef5c124991

SHA1
72132bc89bcf174fd4a40cfb99b309a365c8e4db

SHA256
2f7b91d8a056e89152222115fe01e54dfb3c925096efba7847a069f5d582405a

SHA512
9843c3ea376d72b7641ab7e583e88a1188e36aca6ada3a6912c6e44066bc49db673a692334a14e08bb42e7da3e2719d4decd1bc3effba928c108e1cc25c22fae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\hostr.exe.log

MD5
9424b451803882d2fc76f5ef5c124991

SHA1
72132bc89bcf174fd4a40cfb99b309a365c8e4db

SHA256
2f7b91d8a056e89152222115fe01e54dfb3c925096efba7847a069f5d582405a

SHA512
9843c3ea376d72b7641ab7e583e88a1188e36aca6ada3a6912c6e44066bc49db673a692334a14e08bb42e7da3e2719d4decd1bc3effba928c108e1cc25c22fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\hostr.exe

MD5
d8fe97c45c907fc6dac792590fa11f68

SHA1
b51408881f22a20bb8c1a1a1623e91aff44d15e8

SHA256
280eafd06a8484a10980170c2ff14f344bdae364e52c6680068d2f866175f746

SHA512
ab8cdc9cf24b46ff664d96d4de1b430fb6a16e14b0cd944bbe7f5e4c323b7a120689422bddb7c071d1a52dca8e80cc2dde989cdd693a61b1e27b76ccfa291bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\hostr.exe

MD5
d8fe97c45c907fc6dac792590fa11f68

SHA1
b51408881f22a20bb8c1a1a1623e91aff44d15e8

SHA256
280eafd06a8484a10980170c2ff14f344bdae364e52c6680068d2f866175f746

SHA512
ab8cdc9cf24b46ff664d96d4de1b430fb6a16e14b0cd944bbe7f5e4c323b7a120689422bddb7c071d1a52dca8e80cc2dde989cdd693a61b1e27b76ccfa291bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\hostr.exe

MD5
d8fe97c45c907fc6dac792590fa11f68

SHA1
b51408881f22a20bb8c1a1a1623e91aff44d15e8

SHA256
280eafd06a8484a10980170c2ff14f344bdae364e52c6680068d2f866175f746

SHA512
ab8cdc9cf24b46ff664d96d4de1b430fb6a16e14b0cd944bbe7f5e4c323b7a120689422bddb7c071d1a52dca8e80cc2dde989cdd693a61b1e27b76ccfa291bdf

Download Submit
memory/772-117-0x000000000040897E-mapping.dmp

Download
memory/772-116-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/772-119-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/1416-129-0x0000000000000000-mapping.dmp

Download
memory/3292-120-0x0000000000000000-mapping.dmp

Download
memory/3292-123-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/3484-125-0x000000000040897E-mapping.dmp

Download
memory/3484-128-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/3688-115-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads