njrat | 8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a

General

Target

8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Size

206KB
MD5

be6e448595e3a98ddd11c3cfb49e51e6
SHA1

3be3d8f313d3f4d0421c0f496cd1f8a39a04ec14
SHA256

8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a
SHA512

af37c168d0031ea0ee0a25aa6a7698b02d36c232c195cb067a0966bd1b4aa9ac8045dfcf279fc492013231ed5288ea1dce20f89257618d70a77ab2ebb384972e

Score

10^/10

njrat trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

system.exe

pid process

1796 system.exe

pid	process
1796	system.exe

Drops startup file 1 IoCs

Processes:

8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mysystem.lnk	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exesystem.exe

description	pid	process
Token: SeDebugPrivilege	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Token: 33	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Token: SeIncBasePriorityPrivilege	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Token: 33	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Token: SeIncBasePriorityPrivilege	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Token: 33	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Token: SeIncBasePriorityPrivilege	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Token: SeDebugPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Token: SeIncBasePriorityPrivilege	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe
Token: 33	1796	system.exe
Token: SeIncBasePriorityPrivilege	1796	system.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe

description	pid	process	target process
PID 760 wrote to memory of 1796	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe	system.exe
PID 760 wrote to memory of 1796	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe	system.exe
PID 760 wrote to memory of 1796	760	8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe	system.exe

C:\Users\Admin\AppData\Local\Temp\8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe
"C:\Users\Admin\AppData\Local\Temp\8456be962d01eac8e2f40d0a310d767cd5ec44b28d359030b1a04ecea974979a.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760

C:\Users\Admin\AppData\Local\Temp\system.exe
"C:\Users\Admin\AppData\Local\Temp\system.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\system.exe
MD5
22249eb9eda56570f33b44b2ad5f66d7

SHA1
642d93447cfac014b556eebbc997890f09574172

SHA256
ec83453b6fbd05e56ae0a4992b123500ddc36ce3083f113ff44a4e368ec8bc81

SHA512
e9b714ae146482d358cfa6e914c2a1dfd81b163cf48a53c0359b2295357fb36f1e998f67a44a042d06e4f2c66df79c5f576b0475114079763feb7815cbb36bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe
MD5
22249eb9eda56570f33b44b2ad5f66d7

SHA1
642d93447cfac014b556eebbc997890f09574172

SHA256
ec83453b6fbd05e56ae0a4992b123500ddc36ce3083f113ff44a4e368ec8bc81

SHA512
e9b714ae146482d358cfa6e914c2a1dfd81b163cf48a53c0359b2295357fb36f1e998f67a44a042d06e4f2c66df79c5f576b0475114079763feb7815cbb36bf1

Download Submit
memory/760-55-0x0000000001FE0000-0x0000000001FE2000-memory.dmp

Filesize
8KB

Download
memory/760-54-0x000007FEF1F20000-0x000007FEF2FB6000-memory.dmp

Filesize
16.6MB

Download
memory/760-59-0x0000000002005000-0x0000000002006000-memory.dmp

Filesize
4KB

Download
memory/760-60-0x0000000002006000-0x0000000002007000-memory.dmp

Filesize
4KB

Download
memory/760-58-0x0000000001FE6000-0x0000000002005000-memory.dmp

Filesize
124KB

Download
memory/1796-61-0x0000000001FB0000-0x0000000001FB2000-memory.dmp

Filesize
8KB

Download
memory/1796-62-0x000007FEF1F20000-0x000007FEF2FB6000-memory.dmp

Filesize
16.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads