njrat | 9ba526eaa176389b20e270129a403934a9625fdee27f1ad36ed20289f178421c

General

Target

#461432638.exe
Size

979KB
MD5

29bf474d20e0b17a36577c6e903e8afb
SHA1

11cf027edff4d91c634b23972c612a9998b7173f
SHA256

9ba526eaa176389b20e270129a403934a9625fdee27f1ad36ed20289f178421c
SHA512

bab8419ec4c686e01f173ee23a21c4345c8e2f0cf1bd32d7302993b0cdc513b897563f7bb14b589b7920aedec4c027d74fa8924c72a11c83884ddc5b74484cb4

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

1.9

Botnet

HacKed

Mutex

Microsoft.Exe

Attributes

reg_key
Microsoft.Exe

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 2 IoCs

Processes:

#461432638.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.Exe	#461432638.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.Exe	#461432638.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

#461432638.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\#461432638.exe\" .."	#461432638.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\#461432638.exe\" .."	#461432638.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

#461432638.exe

description pid process target process

PID 1580 set thread context of 620 1580 #461432638.exe #461432638.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

560 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

#461432638.exe

pid process

1580 #461432638.exe

description	pid	process	target process
PID 1580 set thread context of 620	1580	#461432638.exe	#461432638.exe

pid	process
560	schtasks.exe

pid	process
1580	#461432638.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

#461432638.exe#461432638.exe

description	pid	process
Token: SeDebugPrivilege	1580	#461432638.exe
Token: SeDebugPrivilege	620	#461432638.exe
Token: 33	620	#461432638.exe
Token: SeIncBasePriorityPrivilege	620	#461432638.exe
Token: 33	620	#461432638.exe
Token: SeIncBasePriorityPrivilege	620	#461432638.exe
Token: 33	620	#461432638.exe
Token: SeIncBasePriorityPrivilege	620	#461432638.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

#461432638.exe#461432638.exe

description	pid	process	target process
PID 1580 wrote to memory of 560	1580	#461432638.exe	schtasks.exe
PID 1580 wrote to memory of 560	1580	#461432638.exe	schtasks.exe
PID 1580 wrote to memory of 560	1580	#461432638.exe	schtasks.exe
PID 1580 wrote to memory of 560	1580	#461432638.exe	schtasks.exe
PID 1580 wrote to memory of 1904	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 1904	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 1904	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 1904	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 620	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 620	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 620	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 620	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 620	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 620	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 620	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 620	1580	#461432638.exe	#461432638.exe
PID 1580 wrote to memory of 620	1580	#461432638.exe	#461432638.exe
PID 620 wrote to memory of 936	620	#461432638.exe	netsh.exe
PID 620 wrote to memory of 936	620	#461432638.exe	netsh.exe
PID 620 wrote to memory of 936	620	#461432638.exe	netsh.exe
PID 620 wrote to memory of 936	620	#461432638.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\#461432638.exe
"C:\Users\Admin\AppData\Local\Temp\#461432638.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NjGbuw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB471.tmp"
2⤵
- Creates scheduled task(s)
PID:560

C:\Users\Admin\AppData\Local\Temp\#461432638.exe
"{path}"
2⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\#461432638.exe
"{path}"
2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\#461432638.exe" "#461432638.exe" ENABLE
3⤵
PID:936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB471.tmp

MD5
622a276766daffb47bbfe2cf38c342d8

SHA1
1448ade969cb6f1ee90ff4c92e0fa55e2024c174

SHA256
00673c21f844db814cc5168421bb0dc73578ffec65e9ce768e9caffccf18bb06

SHA512
8dce915b529e052a58b6076ff2b75c1230d721ba5e66a99cdacbb6a9a90efa0620638d05a64e09abeaa04f9807183e81d316ac39ca598989ac19ed8b9430ab6e

Download Submit
memory/620-63-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/620-62-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/620-64-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/620-66-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/620-67-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/620-70-0x00000000044F0000-0x00000000044F1000-memory.dmp

Filesize
4KB

Download
memory/1580-57-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/1580-58-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/1580-59-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/1580-60-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/1580-56-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1580-55-0x0000000000CA0000-0x0000000000D9A000-memory.dmp

Filesize
1000KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads