njrat | 50b8b19e4501f07b8bb5cff4640776abddc175a8bf352eebdfef908c2b456e30

General

Target

af75bf198fdc4a21ce1758f5843b1036.exe
Size

37KB
MD5

af75bf198fdc4a21ce1758f5843b1036
SHA1

673eb926d11c448cc2a2af4907544068e6c28e25
SHA256

50b8b19e4501f07b8bb5cff4640776abddc175a8bf352eebdfef908c2b456e30
SHA512

abc31ae1f77ade27a35d773b3d527af73bd9f6bff7f55bbd878e364d872495313b31956133bb1ac8e6af6021ba9d91f39a8de09991b09e056fdf47489b31a001

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

4.tcp.ngrok.io:14567

Mutex

2d398c18ec3965eac95679b5b376b4ab

Attributes

reg_key
2d398c18ec3965eac95679b5b376b4ab
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

268 server.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Loads dropped DLL 1 IoCs

Processes:

af75bf198fdc4a21ce1758f5843b1036.exe

pid process

1476 af75bf198fdc4a21ce1758f5843b1036.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
268	server.exe

pid	process
1476	af75bf198fdc4a21ce1758f5843b1036.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe
Token: 33	268	server.exe
Token: SeIncBasePriorityPrivilege	268	server.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

af75bf198fdc4a21ce1758f5843b1036.exeserver.exe

description	pid	process	target process
PID 1476 wrote to memory of 268	1476	af75bf198fdc4a21ce1758f5843b1036.exe	server.exe
PID 1476 wrote to memory of 268	1476	af75bf198fdc4a21ce1758f5843b1036.exe	server.exe
PID 1476 wrote to memory of 268	1476	af75bf198fdc4a21ce1758f5843b1036.exe	server.exe
PID 1476 wrote to memory of 268	1476	af75bf198fdc4a21ce1758f5843b1036.exe	server.exe
PID 268 wrote to memory of 1808	268	server.exe	netsh.exe
PID 268 wrote to memory of 1808	268	server.exe	netsh.exe
PID 268 wrote to memory of 1808	268	server.exe	netsh.exe
PID 268 wrote to memory of 1808	268	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\af75bf198fdc4a21ce1758f5843b1036.exe
"C:\Users\Admin\AppData\Local\Temp\af75bf198fdc4a21ce1758f5843b1036.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476

C:\Users\Admin\AppData\Roaming\server.exe
"C:\Users\Admin\AppData\Roaming\server.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
3⤵
PID:1808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\server.exe
MD5
af75bf198fdc4a21ce1758f5843b1036

SHA1
673eb926d11c448cc2a2af4907544068e6c28e25

SHA256
50b8b19e4501f07b8bb5cff4640776abddc175a8bf352eebdfef908c2b456e30

SHA512
abc31ae1f77ade27a35d773b3d527af73bd9f6bff7f55bbd878e364d872495313b31956133bb1ac8e6af6021ba9d91f39a8de09991b09e056fdf47489b31a001

Download Submit
C:\Users\Admin\AppData\Roaming\server.exe
MD5
af75bf198fdc4a21ce1758f5843b1036

SHA1
673eb926d11c448cc2a2af4907544068e6c28e25

SHA256
50b8b19e4501f07b8bb5cff4640776abddc175a8bf352eebdfef908c2b456e30

SHA512
abc31ae1f77ade27a35d773b3d527af73bd9f6bff7f55bbd878e364d872495313b31956133bb1ac8e6af6021ba9d91f39a8de09991b09e056fdf47489b31a001

Download Submit
\Users\Admin\AppData\Roaming\server.exe
MD5
af75bf198fdc4a21ce1758f5843b1036

SHA1
673eb926d11c448cc2a2af4907544068e6c28e25

SHA256
50b8b19e4501f07b8bb5cff4640776abddc175a8bf352eebdfef908c2b456e30

SHA512
abc31ae1f77ade27a35d773b3d527af73bd9f6bff7f55bbd878e364d872495313b31956133bb1ac8e6af6021ba9d91f39a8de09991b09e056fdf47489b31a001

Download Submit
memory/268-61-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/1476-55-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download
memory/1476-56-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing