njrat | 1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a

General

Target

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Size

374KB
MD5

e8c4a336c901a8799525ea30486838b3
SHA1

856980d3acbed47e7c9cae6c1f0d608888537382
SHA256

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a
SHA512

0eac6f516d36f94631821658d959a13ca73def3e95c32aaa61c4f77d79803f09e2dba587f8921f75eb561bf879c7fd7e8bc00042ceee75ed7a63cc19f9fa9f99

Score

10^/10

njrat evasion trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies registry class 3 IoCs

Processes:

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\CID\{35007600-5000-5500-4C00-440065006E00}	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\CID	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\CID\{35007600-5000-5500-4C00-440065006E00}\1 = "JLkqZJtp+yqaUz9TvQxrN2E+zCTQ87lwP4/Bejm1V3ek4p7l8Qj9Hz1fg3PLD7FOME52zB3wos7jUEhXww21UCBOrW0ra+uxA8OF5yz9m5jg0mEbci2jMte7yUJIrfz8ONU2Gb2bpeY5kPh4Ov7TQgE6AoNPGHycHr931yUUZejzx4uxvdvX5KnrXcvpc1VD5nayY8KbK3+Q7Xt+YvJQNYP4U+hms27S0QnYocrZIfHewi41cRondUAOrpHQGpWNMaQuCQmY9ofwNo1zcWzDBR+OFojXagdMEdFfHqLngiHSDnevS8bpB94WcavFxXl3tAP+zL0tm31V4y62ui+jr/LTFuvpVHihMeyku/KUsu54snFbYQxjUqzHxZzVfIFJJNUWezOZNfsTLTZT4/NQu2NDXv72mso2VkYcUMBYz1RshLmJe3+nOwTO5S6RtDOdyRaihWpZMPQ58mu9c9E+ow=="	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

NTFS ADS 1 IoCs

Processes:

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp:{35007600-5000-5500-4C00-440065006E00}	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

description	pid	process
Token: SeDebugPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

description	pid	process	target process
PID 1468 wrote to memory of 968	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe	netsh.exe
PID 1468 wrote to memory of 968	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe	netsh.exe
PID 1468 wrote to memory of 968	1468	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
"C:\Users\Admin\AppData\Local\Temp\1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe"
1⤵
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\system32\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe" "1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe" ENABLE
  2⤵
  PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/968-57-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Filesize
8KB

Download
memory/1468-54-0x0000000000B00000-0x0000000000B02000-memory.dmp

Filesize
8KB

Download
memory/1468-55-0x000007FEEEB10000-0x000007FEEFBA6000-memory.dmp

Filesize
16.6MB

Download
memory/1468-58-0x0000000000B06000-0x0000000000B25000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads