njrat | 0a9d287a3539c979a8c215ca003ca35293c324644e2f2c4dc3a38b4c7f9fa143

General

Target

A81N2M36C_INV0ICE_RECEIPT.exe
Size

679KB
MD5

ba79aabe98bf01d3f35359a9332be48f
SHA1

0dbca5bfa445fca16f31bddfe3be23b1a41a80c0
SHA256

0a9d287a3539c979a8c215ca003ca35293c324644e2f2c4dc3a38b4c7f9fa143
SHA512

ad16e94537e80d6a185c6be021eb3b459e204fcc424366d89b222849f60ba00478335a036e66c197609f9a77161b093f7240c7ef1d699ff842fd9289d6e828d3

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

1.9

Botnet

HacKed

Mutex

Microsoft.Exe

Attributes

reg_key
Microsoft.Exe

Signatures

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

A81N2M36C_INV0ICE_RECEIPT.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A81N2M36C_INV0ICE_RECEIPT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A81N2M36C_INV0ICE_RECEIPT.exe

Drops startup file 2 IoCs

Processes:

aspnet_compiler.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.Exe	aspnet_compiler.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.Exe	aspnet_compiler.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

A81N2M36C_INV0ICE_RECEIPT.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	A81N2M36C_INV0ICE_RECEIPT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	A81N2M36C_INV0ICE_RECEIPT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\CADCDADBAEDEFBCBFCADB\svchost.exe = "0"	A81N2M36C_INV0ICE_RECEIPT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\A81N2M36C_INV0ICE_RECEIPT.exe = "0"	A81N2M36C_INV0ICE_RECEIPT.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

A81N2M36C_INV0ICE_RECEIPT.exeaspnet_compiler.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\BEABFBACFFDDAFBFBAEECFC = "C:\\Windows\\Microsoft.NET\\Framework\\CADCDADBAEDEFBCBFCADB\\svchost.exe"	A81N2M36C_INV0ICE_RECEIPT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BEABFBACFFDDAFBFBAEECFC = "C:\\Windows\\Microsoft.NET\\Framework\\CADCDADBAEDEFBCBFCADB\\svchost.exe"	A81N2M36C_INV0ICE_RECEIPT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" .."	aspnet_compiler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" .."	aspnet_compiler.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

A81N2M36C_INV0ICE_RECEIPT.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	A81N2M36C_INV0ICE_RECEIPT.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	A81N2M36C_INV0ICE_RECEIPT.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

A81N2M36C_INV0ICE_RECEIPT.exe

description pid process target process

PID 956 set thread context of 1744 956 A81N2M36C_INV0ICE_RECEIPT.exe aspnet_compiler.exe

description	pid	process	target process
PID 956 set thread context of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe

Drops file in Windows directory 2 IoCs

Processes:

A81N2M36C_INV0ICE_RECEIPT.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\CADCDADBAEDEFBCBFCADB\svchost.exe	A81N2M36C_INV0ICE_RECEIPT.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\CADCDADBAEDEFBCBFCADB	A81N2M36C_INV0ICE_RECEIPT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

A81N2M36C_INV0ICE_RECEIPT.exepowershell.exepowershell.exepowershell.exe

pid	process
956	A81N2M36C_INV0ICE_RECEIPT.exe
956	A81N2M36C_INV0ICE_RECEIPT.exe
956	A81N2M36C_INV0ICE_RECEIPT.exe
956	A81N2M36C_INV0ICE_RECEIPT.exe
956	A81N2M36C_INV0ICE_RECEIPT.exe
956	A81N2M36C_INV0ICE_RECEIPT.exe
428	powershell.exe
1572	powershell.exe
1676	powershell.exe
956	A81N2M36C_INV0ICE_RECEIPT.exe
956	A81N2M36C_INV0ICE_RECEIPT.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

A81N2M36C_INV0ICE_RECEIPT.exepowershell.exepowershell.exepowershell.exeaspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	956	A81N2M36C_INV0ICE_RECEIPT.exe
Token: SeDebugPrivilege	428	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1744	aspnet_compiler.exe
Token: 33	1744	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1744	aspnet_compiler.exe
Token: 33	1744	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1744	aspnet_compiler.exe
Token: 33	1744	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1744	aspnet_compiler.exe
Token: 33	1744	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1744	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

A81N2M36C_INV0ICE_RECEIPT.exeaspnet_compiler.exe

description	pid	process	target process
PID 956 wrote to memory of 1572	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 1572	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 1572	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 1572	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 1676	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 1676	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 1676	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 1676	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 428	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 428	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 428	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 428	956	A81N2M36C_INV0ICE_RECEIPT.exe	powershell.exe
PID 956 wrote to memory of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe
PID 956 wrote to memory of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe
PID 956 wrote to memory of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe
PID 956 wrote to memory of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe
PID 956 wrote to memory of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe
PID 956 wrote to memory of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe
PID 956 wrote to memory of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe
PID 956 wrote to memory of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe
PID 956 wrote to memory of 1744	956	A81N2M36C_INV0ICE_RECEIPT.exe	aspnet_compiler.exe
PID 1744 wrote to memory of 336	1744	aspnet_compiler.exe	netsh.exe
PID 1744 wrote to memory of 336	1744	aspnet_compiler.exe	netsh.exe
PID 1744 wrote to memory of 336	1744	aspnet_compiler.exe	netsh.exe
PID 1744 wrote to memory of 336	1744	aspnet_compiler.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\A81N2M36C_INV0ICE_RECEIPT.exe
"C:\Users\Admin\AppData\Local\Temp\A81N2M36C_INV0ICE_RECEIPT.exe"
1⤵
- Checks BIOS information in registry
- Windows security modification
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\CADCDADBAEDEFBCBFCADB\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\CADCDADBAEDEFBCBFCADB\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\A81N2M36C_INV0ICE_RECEIPT.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" "aspnet_compiler.exe" ENABLE
    3⤵
    PID:336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5
b08715603b1a10e0c850f5801ecb903e

SHA1
8279db8ad769a09a3149ae622b3524594d239da8

SHA256
468575eca6d130b6168a8a76b0edc323221b92b0ec25e61c008a6f64be7f245e

SHA512
afa3a610236545001e6335a3908401537b908bc82a306518e7f0e29eb5c0ef7d70059583da47ced5e72bbc505dbe379d5995376a73454239e9160e051321e4e0

Download Submit
memory/336-82-0x0000000000000000-mapping.dmp

Download
memory/428-81-0x0000000002330000-0x0000000002F7A000-memory.dmp

Filesize
12.3MB

Download
memory/428-60-0x0000000000000000-mapping.dmp

Download
memory/428-75-0x0000000002330000-0x0000000002F7A000-memory.dmp

Filesize
12.3MB

Download
memory/428-78-0x0000000002330000-0x0000000002F7A000-memory.dmp

Filesize
12.3MB

Download
memory/956-57-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/956-56-0x0000000000700000-0x000000000071A000-memory.dmp

Filesize
104KB

Download
memory/956-55-0x00000000020A0000-0x0000000002142000-memory.dmp

Filesize
648KB

Download
memory/956-54-0x0000000000810000-0x00000000008C0000-memory.dmp

Filesize
704KB

Download
memory/1572-58-0x0000000000000000-mapping.dmp

Download
memory/1572-61-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download
memory/1572-79-0x0000000001CB2000-0x0000000001CB4000-memory.dmp

Filesize
8KB

Download
memory/1572-77-0x0000000001CB1000-0x0000000001CB2000-memory.dmp

Filesize
4KB

Download
memory/1572-73-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/1676-74-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/1676-76-0x00000000022B1000-0x00000000022B2000-memory.dmp

Filesize
4KB

Download
memory/1676-80-0x00000000022B2000-0x00000000022B4000-memory.dmp

Filesize
8KB

Download
memory/1676-59-0x0000000000000000-mapping.dmp

Download
memory/1744-71-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1744-72-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1744-65-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1744-66-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1744-69-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1744-70-0x000000000040BBF2-mapping.dmp

Download
memory/1744-67-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1744-68-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1744-84-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads