njrat | 9dd8cb6a13209dd543925a620620d23fb74f5e615c0cd6b3a7c0b208f9fcbeb6

General

Target

a5c53ee866d51d6af63e79e7c37e9871.exe
Size

43KB
MD5

a5c53ee866d51d6af63e79e7c37e9871
SHA1

45284d2633c196757c2b7bba35246a30dbc20454
SHA256

9dd8cb6a13209dd543925a620620d23fb74f5e615c0cd6b3a7c0b208f9fcbeb6
SHA512

c08242a988ca7668ebcb6ea9235655ea17670325b4912189e2723728f85878da58e495d1f455c1d06466ed7acec036fb12a4a040fb7866403adae7c9cb7603dc

Score

10^/10

njrat hacked suricata trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

6.tcp.ngrok.io:17656

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Executes dropped EXE 1 IoCs

Processes:

rawetrip.exe

pid process

1104 rawetrip.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

a5c53ee866d51d6af63e79e7c37e9871.exerawetrip.exe

pid process

3312 a5c53ee866d51d6af63e79e7c37e9871.exe
1104 rawetrip.exe

pid	process
1104	rawetrip.exe

pid	process
3312	a5c53ee866d51d6af63e79e7c37e9871.exe
1104	rawetrip.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

rawetrip.exe

description	pid	process
Token: SeDebugPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe
Token: 33	1104	rawetrip.exe
Token: SeIncBasePriorityPrivilege	1104	rawetrip.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a5c53ee866d51d6af63e79e7c37e9871.exe

description	pid	process	target process
PID 3312 wrote to memory of 1104	3312	a5c53ee866d51d6af63e79e7c37e9871.exe	rawetrip.exe
PID 3312 wrote to memory of 1104	3312	a5c53ee866d51d6af63e79e7c37e9871.exe	rawetrip.exe
PID 3312 wrote to memory of 1104	3312	a5c53ee866d51d6af63e79e7c37e9871.exe	rawetrip.exe

C:\Users\Admin\AppData\Local\Temp\a5c53ee866d51d6af63e79e7c37e9871.exe
"C:\Users\Admin\AppData\Local\Temp\a5c53ee866d51d6af63e79e7c37e9871.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3312

C:\Users\Admin\AppData\Roaming\rawetrip.exe
"C:\Users\Admin\AppData\Roaming\rawetrip.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\rawetrip.exe
MD5
a5c53ee866d51d6af63e79e7c37e9871

SHA1
45284d2633c196757c2b7bba35246a30dbc20454

SHA256
9dd8cb6a13209dd543925a620620d23fb74f5e615c0cd6b3a7c0b208f9fcbeb6

SHA512
c08242a988ca7668ebcb6ea9235655ea17670325b4912189e2723728f85878da58e495d1f455c1d06466ed7acec036fb12a4a040fb7866403adae7c9cb7603dc

Download Submit
C:\Users\Admin\AppData\Roaming\rawetrip.exe
MD5
a5c53ee866d51d6af63e79e7c37e9871

SHA1
45284d2633c196757c2b7bba35246a30dbc20454

SHA256
9dd8cb6a13209dd543925a620620d23fb74f5e615c0cd6b3a7c0b208f9fcbeb6

SHA512
c08242a988ca7668ebcb6ea9235655ea17670325b4912189e2723728f85878da58e495d1f455c1d06466ed7acec036fb12a4a040fb7866403adae7c9cb7603dc

Download Submit
memory/1104-121-0x0000000000000000-mapping.dmp

Download
memory/1104-129-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/1104-130-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/1104-131-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/1104-132-0x00000000063E0000-0x00000000063E1000-memory.dmp

Filesize
4KB

Download
memory/3312-115-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download
memory/3312-117-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/3312-118-0x00000000060A0000-0x00000000060A1000-memory.dmp

Filesize
4KB

Download
memory/3312-119-0x0000000005A80000-0x0000000005A81000-memory.dmp

Filesize
4KB

Download
memory/3312-120-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing