njrat | 81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92

General

Target

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
Size

1012KB
MD5

a60b0e5cd78850a7ac0912bfa464640a
SHA1

a0083fce727c42a3e5b359ce7677573175b7fee1
SHA256

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92
SHA512

8a9d9858fb59f7c40f13e016645c9239ec3ff33ed8f55295303cc7986493871a93123cf2df15ac1d926d9c5e80ea85fd5fb9a4f19546190d4449eba88892a0ac

Score

10^/10

njrat zzzpam persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

zzZpam

C2

dominoduck2070.duckdns.org:2093

Mutex

Chrome.exe

Attributes

reg_key
Chrome.exe
splitter
1193

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\gSyNxeWgdx = "C:\\Users\\Public\\gSyNxeWgdx.vbs"	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

description	pid	process	target process
PID 2640 set thread context of 3924	2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe
Token: 33	3924	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3924	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

pid	process
2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

pid	process
2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe

description	pid	process	target process
PID 2640 wrote to memory of 3924	2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 2640 wrote to memory of 3924	2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 2640 wrote to memory of 3924	2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 2640 wrote to memory of 3924	2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe
PID 2640 wrote to memory of 3924	2640	81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe
"C:\Users\Admin\AppData\Local\Temp\81392d047dfd568341b4adc8191804dfb0567bc92eb0c60d71e2d277e6178a92.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-118-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/3924-119-0x0000000000350000-0x000000000036A000-memory.dmp

Filesize
104KB

Download
memory/3924-124-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads