Resubmissions
25-01-2022 09:50
220125-ltxepsdee4 10Analysis
-
max time kernel
125s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 09:50
Static task
static1
Behavioral task
behavioral1
Sample
njRAT.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
njRAT.exe
Resource
win10-en-20211208
General
-
Target
njRAT.exe
-
Size
959KB
-
MD5
0431311b5f024d6e66b90d59491f2563
-
SHA1
e9ff4da7e3f2199cbc16d37d8935cb1b0567ac2a
-
SHA256
fd624aa205517580e83fad7a4ce4d64863e95f62b34ac72647b1974a52822199
-
SHA512
d44b14e4b24e6e2d506ec32098488a16ebd5df57499ecd85e8878b8af2a3e1f9ed20d4125836417b702d0571f992aeac07af051dbf9268f48954556d17f51ee2
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
njRAT.exenjq8.exewindows.exepid process 580 njRAT.exe 1240 njq8.exe 896 windows.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
windows.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecc7c8c51c0850c1ec247c7fd3602f20.exe windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecc7c8c51c0850c1ec247c7fd3602f20.exe windows.exe -
Loads dropped DLL 1 IoCs
Processes:
njq8.exepid process 1240 njq8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
windows.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
windows.exepid process 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe 896 windows.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
windows.exedescription pid process Token: SeDebugPrivilege 896 windows.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
njRAT.exenjq8.exewindows.exedescription pid process target process PID 1796 wrote to memory of 580 1796 njRAT.exe njRAT.exe PID 1796 wrote to memory of 580 1796 njRAT.exe njRAT.exe PID 1796 wrote to memory of 580 1796 njRAT.exe njRAT.exe PID 1796 wrote to memory of 580 1796 njRAT.exe njRAT.exe PID 1796 wrote to memory of 1240 1796 njRAT.exe njq8.exe PID 1796 wrote to memory of 1240 1796 njRAT.exe njq8.exe PID 1796 wrote to memory of 1240 1796 njRAT.exe njq8.exe PID 1796 wrote to memory of 1240 1796 njRAT.exe njq8.exe PID 1240 wrote to memory of 896 1240 njq8.exe windows.exe PID 1240 wrote to memory of 896 1240 njq8.exe windows.exe PID 1240 wrote to memory of 896 1240 njq8.exe windows.exe PID 1240 wrote to memory of 896 1240 njq8.exe windows.exe PID 896 wrote to memory of 1300 896 windows.exe netsh.exe PID 896 wrote to memory of 1300 896 windows.exe netsh.exe PID 896 wrote to memory of 1300 896 windows.exe netsh.exe PID 896 wrote to memory of 1300 896 windows.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\njRAT.exe"C:\Users\Admin\AppData\Local\Temp\njRAT.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\njRAT.exe"C:\njRAT.exe"2⤵
- Executes dropped EXE
-
C:\njq8.exe"C:\njq8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLE4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\windows.exeMD5
edc4f10a5e164db64bf79eca207f2749
SHA1d08eb761a5446a4409a72f3af3fb8dd60eec7c92
SHA256ce6421107031175f39e61d3bcc5a98d1d94190e250034e27cdbebbadcba084a4
SHA512e974a32096cc58c1a78c7aa8714b8b8b7a202859905a28d5ce61fd9a563382a7577825e8c9ee612d7ba708f3efef01a43d07df03e7c1e3e52d0cb32240d5d15d
-
C:\Users\Admin\AppData\Local\Temp\windows.exeMD5
edc4f10a5e164db64bf79eca207f2749
SHA1d08eb761a5446a4409a72f3af3fb8dd60eec7c92
SHA256ce6421107031175f39e61d3bcc5a98d1d94190e250034e27cdbebbadcba084a4
SHA512e974a32096cc58c1a78c7aa8714b8b8b7a202859905a28d5ce61fd9a563382a7577825e8c9ee612d7ba708f3efef01a43d07df03e7c1e3e52d0cb32240d5d15d
-
C:\njRAT.exeMD5
08f223ac15e2e92561ed310ae71415c1
SHA10a871a4b376bd8771188b96a9a1bb6fe1205160d
SHA25651f2aec8b6de1e49b1ca74203afd380484932b07067a91f027548bc20b8967ec
SHA5129acc7b4976c23fa019361b52eb22dcdfbf0bb1039aa8c8e74507f0501709616757a2d762d0478956a03bfadecdee812c9aa2360655891ab4ed1de96f35e23cd4
-
C:\njRAT.exeMD5
08f223ac15e2e92561ed310ae71415c1
SHA10a871a4b376bd8771188b96a9a1bb6fe1205160d
SHA25651f2aec8b6de1e49b1ca74203afd380484932b07067a91f027548bc20b8967ec
SHA5129acc7b4976c23fa019361b52eb22dcdfbf0bb1039aa8c8e74507f0501709616757a2d762d0478956a03bfadecdee812c9aa2360655891ab4ed1de96f35e23cd4
-
C:\njq8.exeMD5
edc4f10a5e164db64bf79eca207f2749
SHA1d08eb761a5446a4409a72f3af3fb8dd60eec7c92
SHA256ce6421107031175f39e61d3bcc5a98d1d94190e250034e27cdbebbadcba084a4
SHA512e974a32096cc58c1a78c7aa8714b8b8b7a202859905a28d5ce61fd9a563382a7577825e8c9ee612d7ba708f3efef01a43d07df03e7c1e3e52d0cb32240d5d15d
-
C:\njq8.exeMD5
edc4f10a5e164db64bf79eca207f2749
SHA1d08eb761a5446a4409a72f3af3fb8dd60eec7c92
SHA256ce6421107031175f39e61d3bcc5a98d1d94190e250034e27cdbebbadcba084a4
SHA512e974a32096cc58c1a78c7aa8714b8b8b7a202859905a28d5ce61fd9a563382a7577825e8c9ee612d7ba708f3efef01a43d07df03e7c1e3e52d0cb32240d5d15d
-
\Users\Admin\AppData\Local\Temp\windows.exeMD5
edc4f10a5e164db64bf79eca207f2749
SHA1d08eb761a5446a4409a72f3af3fb8dd60eec7c92
SHA256ce6421107031175f39e61d3bcc5a98d1d94190e250034e27cdbebbadcba084a4
SHA512e974a32096cc58c1a78c7aa8714b8b8b7a202859905a28d5ce61fd9a563382a7577825e8c9ee612d7ba708f3efef01a43d07df03e7c1e3e52d0cb32240d5d15d
-
memory/580-63-0x00000000005E0000-0x00000000005E1000-memory.dmpFilesize
4KB
-
memory/580-70-0x00000000005E1000-0x00000000005E2000-memory.dmpFilesize
4KB
-
memory/580-71-0x00000000005E6000-0x00000000005F7000-memory.dmpFilesize
68KB
-
memory/896-69-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1240-65-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/1796-54-0x0000000000C50000-0x0000000000D48000-memory.dmpFilesize
992KB
-
memory/1796-56-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/1796-55-0x0000000076C61000-0x0000000076C63000-memory.dmpFilesize
8KB