njrat | 6ab420972ed80355eeb88e3f08d4e9124141012b6a25e4f2ed6c19235da10d21

General

Target

Ley N° (0080876540).exe
Size

670KB
MD5

c9bc2ade28395d0077523ecde62bf6ab
SHA1

aa815fa396dcc8549e5a1b39445b517c092acd72
SHA256

6ab420972ed80355eeb88e3f08d4e9124141012b6a25e4f2ed6c19235da10d21
SHA512

1aaca0dcc9974c14f2d724e3f507a86b4ccfe6b5932ceb9d0089774e32729f5ecb6e86f9742f803711f50aabf7e6f2d43c4ab2ce939abad2a553ac4699abac9e

Score

10^/10

njrat 24-ene evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

24-ene

C2

googlemaintenanceservice.duckdns.org:7856

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
ultimate

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Ley N° (0080876540).exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ley N° (0080876540).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ley N° (0080876540).exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Ley N° (0080876540).exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Ley N° (0080876540).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Ley N° (0080876540).exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Ley N° (0080876540).exe

description pid process target process

PID 2532 set thread context of 3948 2532 Ley N° (0080876540).exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1780 schtasks.exe

description	pid	process	target process
PID 2532 set thread context of 3948	2532	Ley N° (0080876540).exe	RegSvcs.exe

pid	process
1780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

Ley N° (0080876540).exepowershell.exepowershell.exe

pid	process
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
2532	Ley N° (0080876540).exe
4064	powershell.exe
2532	Ley N° (0080876540).exe
4064	powershell.exe
1176	powershell.exe
2532	Ley N° (0080876540).exe
1176	powershell.exe
4064	powershell.exe
1176	powershell.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

Ley N° (0080876540).exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2532	Ley N° (0080876540).exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	3948	RegSvcs.exe
Token: 33	3948	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3948	RegSvcs.exe
Token: 33	3948	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3948	RegSvcs.exe
Token: 33	3948	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3948	RegSvcs.exe
Token: 33	3948	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3948	RegSvcs.exe
Token: 33	3948	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3948	RegSvcs.exe
Token: 33	3948	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3948	RegSvcs.exe
Token: 33	3948	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3948	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Ley N° (0080876540).exe

description	pid	process	target process
PID 2532 wrote to memory of 4064	2532	Ley N° (0080876540).exe	powershell.exe
PID 2532 wrote to memory of 4064	2532	Ley N° (0080876540).exe	powershell.exe
PID 2532 wrote to memory of 4064	2532	Ley N° (0080876540).exe	powershell.exe
PID 2532 wrote to memory of 1176	2532	Ley N° (0080876540).exe	powershell.exe
PID 2532 wrote to memory of 1176	2532	Ley N° (0080876540).exe	powershell.exe
PID 2532 wrote to memory of 1176	2532	Ley N° (0080876540).exe	powershell.exe
PID 2532 wrote to memory of 1780	2532	Ley N° (0080876540).exe	schtasks.exe
PID 2532 wrote to memory of 1780	2532	Ley N° (0080876540).exe	schtasks.exe
PID 2532 wrote to memory of 1780	2532	Ley N° (0080876540).exe	schtasks.exe
PID 2532 wrote to memory of 3948	2532	Ley N° (0080876540).exe	RegSvcs.exe
PID 2532 wrote to memory of 3948	2532	Ley N° (0080876540).exe	RegSvcs.exe
PID 2532 wrote to memory of 3948	2532	Ley N° (0080876540).exe	RegSvcs.exe
PID 2532 wrote to memory of 3948	2532	Ley N° (0080876540).exe	RegSvcs.exe
PID 2532 wrote to memory of 3948	2532	Ley N° (0080876540).exe	RegSvcs.exe
PID 2532 wrote to memory of 3948	2532	Ley N° (0080876540).exe	RegSvcs.exe
PID 2532 wrote to memory of 3948	2532	Ley N° (0080876540).exe	RegSvcs.exe
PID 2532 wrote to memory of 3948	2532	Ley N° (0080876540).exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Ley N° (0080876540).exe
"C:\Users\Admin\AppData\Local\Temp\Ley N° (0080876540).exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ley N° (0080876540).exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qnnHkykD.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qnnHkykD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp11CA.tmp"
2⤵
- Creates scheduled task(s)
PID:1780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
aa4b5e80f2805d33b5fab73241de4259

SHA1
b72b31c8c74c49a698449c39ad539590f2c671aa

SHA256
81f2f05b15d9023689a2d1b6a6a46fad681bdfb4eb1168a92ac1915c8e46a693

SHA512
ffdd452d17b2adda6eaf15627227ae36a4f36065d1e6ecd11c98f56e38814faf6e39636542f98e3043910587aa92cbc4ee682fbaa654579cdbbbd4e753de6590

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp11CA.tmp
MD5
a20e9d4805cdf592c93f819bc9c707b3

SHA1
4a75ee33097eb41a0671e917245ea318265c018e

SHA256
31a3809e03820495b5e3e3260e5a9f775c0415ced85f4a0afbd6af2e5f559f6a

SHA512
0086e3007d6e5e9cab191027ec8b4cefd99a1ff482b83521fa9464bc37ff70dfdef726a2ccfa9a79104bfa9633a7e3adeaf8b2eb2dc007211c31305a66623401

Download Submit
memory/1176-144-0x0000000007372000-0x0000000007373000-memory.dmp

Filesize
4KB

Download
memory/1176-163-0x0000000009770000-0x000000000978E000-memory.dmp

Filesize
120KB

Download
memory/1176-143-0x0000000007370000-0x0000000007371000-memory.dmp

Filesize
4KB

Download
memory/1176-174-0x000000007E780000-0x000000007E781000-memory.dmp

Filesize
4KB

Download
memory/1176-190-0x0000000007373000-0x0000000007374000-memory.dmp

Filesize
4KB

Download
memory/1176-572-0x0000000007470000-0x0000000007478000-memory.dmp

Filesize
32KB

Download
memory/2532-122-0x0000000004C20000-0x0000000004CB2000-memory.dmp

Filesize
584KB

Download
memory/2532-127-0x0000000000DA0000-0x0000000000E06000-memory.dmp

Filesize
408KB

Download
memory/2532-126-0x0000000007560000-0x00000000075A2000-memory.dmp

Filesize
264KB

Download
memory/2532-125-0x000000007EB00000-0x000000007EB01000-memory.dmp

Filesize
4KB

Download
memory/2532-124-0x00000000071F0000-0x00000000071FE000-memory.dmp

Filesize
56KB

Download
memory/2532-123-0x0000000007200000-0x000000000729C000-memory.dmp

Filesize
624KB

Download
memory/2532-121-0x0000000004CD0000-0x0000000004CDA000-memory.dmp

Filesize
40KB

Download
memory/2532-120-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Filesize
584KB

Download
memory/2532-119-0x0000000005210000-0x000000000570E000-memory.dmp

Filesize
5.0MB

Download
memory/2532-118-0x00000000003F0000-0x000000000049E000-memory.dmp

Filesize
696KB

Download
memory/3948-140-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3948-314-0x00000000050A0000-0x000000000559E000-memory.dmp

Filesize
5.0MB

Download
memory/4064-162-0x0000000008AC0000-0x0000000008AF3000-memory.dmp

Filesize
204KB

Download
memory/4064-172-0x000000007EB50000-0x000000007EB51000-memory.dmp

Filesize
4KB

Download
memory/4064-145-0x0000000007C60000-0x0000000007CD6000-memory.dmp

Filesize
472KB

Download
memory/4064-142-0x0000000007E70000-0x0000000007EBB000-memory.dmp

Filesize
300KB

Download
memory/4064-175-0x0000000008FD0000-0x0000000009064000-memory.dmp

Filesize
592KB

Download
memory/4064-173-0x0000000008E20000-0x0000000008EC5000-memory.dmp

Filesize
660KB

Download
memory/4064-137-0x00000000007D0000-0x00000000007E0000-memory.dmp

Filesize
64KB

Download
memory/4064-135-0x0000000007590000-0x00000000078E0000-memory.dmp

Filesize
3.3MB

Download
memory/4064-134-0x00000000007D0000-0x00000000007E0000-memory.dmp

Filesize
64KB

Download
memory/4064-187-0x00000000007D0000-0x00000000007E0000-memory.dmp

Filesize
64KB

Download
memory/4064-133-0x0000000006BF0000-0x0000000006C56000-memory.dmp

Filesize
408KB

Download
memory/4064-141-0x0000000006D60000-0x0000000006D7C000-memory.dmp

Filesize
112KB

Download
memory/4064-563-0x00000000067E0000-0x00000000067FA000-memory.dmp

Filesize
104KB

Download
memory/4064-132-0x0000000006B50000-0x0000000006B72000-memory.dmp

Filesize
136KB

Download
memory/4064-131-0x0000000006D80000-0x00000000073A8000-memory.dmp

Filesize
6.2MB

Download
memory/4064-130-0x0000000004230000-0x0000000004266000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads