njrat | 611509df45740038c9a6548c00976f7e303fe9bd62391556a2d94137b554ad4a

General

Target

ffe93d93fabb62adf6b21744bca44679.exe
Size

31KB
MD5

ffe93d93fabb62adf6b21744bca44679
SHA1

364431eea6e43f495bd1ec4f81045d4d6562b4de
SHA256

611509df45740038c9a6548c00976f7e303fe9bd62391556a2d94137b554ad4a
SHA512

6aa29b62a3cb7420935ddfb25eb1760d10ce96c1eb5fdba46177b14229dc8d616bb45d156a006cecc5cd9b42342f097d93de0d7c845f68a515c22aff35100b83

Score

10^/10

njrat evasion trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

ffe93d93fabb62adf6b21744bca44679.exe

description	pid	process
Token: SeDebugPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: 33	784	ffe93d93fabb62adf6b21744bca44679.exe
Token: SeIncBasePriorityPrivilege	784	ffe93d93fabb62adf6b21744bca44679.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ffe93d93fabb62adf6b21744bca44679.exe

description	pid	process	target process
PID 784 wrote to memory of 1088	784	ffe93d93fabb62adf6b21744bca44679.exe	netsh.exe
PID 784 wrote to memory of 1088	784	ffe93d93fabb62adf6b21744bca44679.exe	netsh.exe
PID 784 wrote to memory of 1088	784	ffe93d93fabb62adf6b21744bca44679.exe	netsh.exe
PID 784 wrote to memory of 1088	784	ffe93d93fabb62adf6b21744bca44679.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\ffe93d93fabb62adf6b21744bca44679.exe
"C:\Users\Admin\AppData\Local\Temp\ffe93d93fabb62adf6b21744bca44679.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\ffe93d93fabb62adf6b21744bca44679.exe" "ffe93d93fabb62adf6b21744bca44679.exe" ENABLE
2⤵
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-55-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download
memory/784-56-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1088-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing