njrat | 1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a

General

Target

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Size

374KB
MD5

e8c4a336c901a8799525ea30486838b3
SHA1

856980d3acbed47e7c9cae6c1f0d608888537382
SHA256

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a
SHA512

0eac6f516d36f94631821658d959a13ca73def3e95c32aaa61c4f77d79803f09e2dba587f8921f75eb561bf879c7fd7e8bc00042ceee75ed7a63cc19f9fa9f99

Score

10^/10

njrat evasion trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies registry class 3 IoCs

Processes:

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\CID\{35007600-5000-5500-4C00-440065006E00}	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\CID	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\CID\{35007600-5000-5500-4C00-440065006E00}\1 = "JLkqZJtp+yqaUz9TvQxrN2E+zCTQ87lwP4/Bejm1V3ek4p7l8Qj9Hz1fg3PLD7FOeMgBKNJ6einMBtrHZhHkoYoEbLRjau3on29tAYExtyFPvxLECzLeICRxwAJPBRovQtJPAin5QzMzSFtMHj2XNm3dnj1lMRdBr71fbroG7zAv/8ZjaSaLZPJ4KO+VBpMaWFLinCGBccPQnZ0eCuqIDAKmWOuMbyhTyXun+B271PLFIStsRD0Pwng+sgD+srz4y/mPnwJropM3qTYJz6ONNw3V9fAf/dAW5YHP7kjn0SPAvIk0MS3THmHjVi0OLX7zgSTq0QqzYWjpV2pYdX6jRQI2oBkslpWun2Eb0PBD+5Kx1jdYPHvqSgqgqkr9hW6NZLMlXOYCTVdbwyIKp6p9tmTj+OQ02nmlllGuySMV7xtJoEA3SvEXV7bewX3IhXqImtmRk9WRCmhNn09RceC0jA=="	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

NTFS ADS 1 IoCs

Processes:

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp:{35007600-5000-5500-4C00-440065006E00}	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

description	pid	process
Token: SeDebugPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: 33	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
Token: SeIncBasePriorityPrivilege	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe

description	pid	process	target process
PID 2368 wrote to memory of 4064	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe	netsh.exe
PID 2368 wrote to memory of 4064	2368	1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe
"C:\Users\Admin\AppData\Local\Temp\1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe"
1⤵
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SYSTEM32\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe" "1f706c309a0658a6753a7585a1bfb2d30fcfacc8e417c8bd7d62c78a26597d7a.exe" ENABLE
  2⤵
  PID:4064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2368-117-0x00000000015B0000-0x00000000015B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads