njrat | 0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487

General

Target

0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe
Size

274KB
MD5

94c2a55970ad8b796e7610a8a8999a60
SHA1

9cfdb16851a0c9a5e698ac34cdc59d50dc8e8cf9
SHA256

0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487
SHA512

5bdcaa4d746f0b004392aee2b2d7103571d140ae23ee4ee3aa25f7ec6e50175610321fe2db5cc263ab9ae3bb8386b9f8a755ac119b519095836046ece64456f3

Score

10^/10

njrat notificación persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

NOTIFICACIÓN

C2

rewt6.duckdns.org:1990

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
1990

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" .."	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" .."	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe

description	pid	process	target process
PID 2652 set thread context of 624	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

912 schtasks.exe
2648 schtasks.exe

pid	process
912	schtasks.exe
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe

pid	process
2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe
2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe
2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe
2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe
Token: SeDebugPrivilege	624	RegSvcs.exe
Token: 33	624	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	624	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exeRegSvcs.exe

description	pid	process	target process
PID 2652 wrote to memory of 912	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	schtasks.exe
PID 2652 wrote to memory of 912	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	schtasks.exe
PID 2652 wrote to memory of 912	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	schtasks.exe
PID 2652 wrote to memory of 624	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	RegSvcs.exe
PID 2652 wrote to memory of 624	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	RegSvcs.exe
PID 2652 wrote to memory of 624	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	RegSvcs.exe
PID 2652 wrote to memory of 624	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	RegSvcs.exe
PID 2652 wrote to memory of 624	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	RegSvcs.exe
PID 2652 wrote to memory of 624	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	RegSvcs.exe
PID 2652 wrote to memory of 624	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	RegSvcs.exe
PID 2652 wrote to memory of 624	2652	0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe	RegSvcs.exe
PID 624 wrote to memory of 1500	624	RegSvcs.exe	schtasks.exe
PID 624 wrote to memory of 1500	624	RegSvcs.exe	schtasks.exe
PID 624 wrote to memory of 1500	624	RegSvcs.exe	schtasks.exe
PID 624 wrote to memory of 2648	624	RegSvcs.exe	schtasks.exe
PID 624 wrote to memory of 2648	624	RegSvcs.exe	schtasks.exe
PID 624 wrote to memory of 2648	624	RegSvcs.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe
"C:\Users\Admin\AppData\Local\Temp\0cddbc246dd35d0e7707910f12c968b7cebeb102afb61292aff19021d21fb487.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BowPmeNnBRwNr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2414.tmp"
2⤵
- Creates scheduled task(s)
PID:912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
3⤵
PID:1500

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" /sc minute /mo 1
3⤵
- Creates scheduled task(s)
PID:2648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2414.tmp
MD5
224ed15495d0aeb41f6e6f64fc81317a

SHA1
c179e8f6ddf64571e83224ac50be90ea0a47df29

SHA256
c1b23062bd4e78805526bd1e6530dfde8e55b37ba7ec660e24aceb269a5ab9b8

SHA512
d310fb1296419400a3b5669c5d141c873ddb4520a765d268dd19b8900e2aa2aa4b3b48c2b0f2e696a34df73c061fae92b334b0095a289f9e11a0346da8186634

Download Submit
memory/624-125-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/624-126-0x0000000004F90000-0x000000000548E000-memory.dmp

Filesize
5.0MB

Download
memory/2652-115-0x00000000005F0000-0x000000000063A000-memory.dmp

Filesize
296KB

Download
memory/2652-116-0x00000000053E0000-0x00000000058DE000-memory.dmp

Filesize
5.0MB

Download
memory/2652-117-0x0000000004EE0000-0x0000000004F72000-memory.dmp

Filesize
584KB

Download
memory/2652-118-0x0000000004EE0000-0x00000000053DE000-memory.dmp

Filesize
5.0MB

Download
memory/2652-119-0x0000000005260000-0x000000000526A000-memory.dmp

Filesize
40KB

Download
memory/2652-120-0x00000000058E0000-0x000000000597C000-memory.dmp

Filesize
624KB

Download
memory/2652-121-0x00000000052E0000-0x00000000052EA000-memory.dmp

Filesize
40KB

Download
memory/2652-122-0x0000000005B30000-0x0000000005B6C000-memory.dmp

Filesize
240KB

Download
memory/2652-123-0x0000000008000000-0x000000000801A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads