njrat | 81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92

General

Target

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
Size

1012KB
MD5

a60b0e5cd78850a7ac0912bfa464640a
SHA1

a0083fce727c42a3e5b359ce7677573175b7fee1
SHA256

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92
SHA512

8a9d9858fb59f7c40f13e016645c9239ec3ff33ed8f55295303cc7986493871a93123cf2df15ac1d926d9c5e80ea85fd5fb9a4f19546190d4449eba88892a0ac

Score

10^/10

njrat zzzpam persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

zzZpam

C2

dominoduck2070.duckdns.org:2093

Mutex

Chrome.exe

Attributes

reg_key
Chrome.exe
splitter
1193

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\gSyNxeWgdx = "C:\\Users\\Public\\gSyNxeWgdx.vbs"	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

description	pid	process	target process
PID 540 set thread context of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe
Token: 33	288	RegAsm.exe
Token: SeIncBasePriorityPrivilege	288	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

pid	process
540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

pid	process
540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

description	pid	process	target process
PID 540 wrote to memory of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 540 wrote to memory of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 540 wrote to memory of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 540 wrote to memory of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 540 wrote to memory of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 540 wrote to memory of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 540 wrote to memory of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 540 wrote to memory of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 540 wrote to memory of 288	540	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
"C:\Users\Admin\AppData\Local\Temp\81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-56-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/288-57-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/288-62-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/288-63-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/288-65-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/540-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/540-55-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads