njrat | 0a70a884c4386a12cd5dcb5b8a6db76f4deff1a39ccaa178f71cfa600619db88

General

Target

0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe
Size

718KB
MD5

e418beb7300b3d82e35d020fca955340
SHA1

42dfb1ed5e837dab445fa9cdb24caa641a17b94c
SHA256

0a70a884c4386a12cd5dcb5b8a6db76f4deff1a39ccaa178f71cfa600619db88
SHA512

b83e638525845c6f55c0e82a0f245fa8ee4ac8dff2d871696f7762686d9458dabc2c9b33b5be1b557765181c6385010c67c1f6dfc9d0f0c872e78eb04db1f2fb

Score

10^/10

njrat nyan cat trojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

milla.publicvm.com:5050

Mutex

dc7afde8db824

Attributes

reg_key
dc7afde8db824
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe

description pid process target process

PID 812 set thread context of 2780 812 0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

728 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe

pid process

812 0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe

description	pid	process	target process
PID 812 set thread context of 2780	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	MSBuild.exe

pid	process
728	schtasks.exe

pid	process
812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe
Token: SeDebugPrivilege	2780	MSBuild.exe
Token: 33	2780	MSBuild.exe
Token: SeIncBasePriorityPrivilege	2780	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe

description	pid	process	target process
PID 812 wrote to memory of 728	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	schtasks.exe
PID 812 wrote to memory of 728	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	schtasks.exe
PID 812 wrote to memory of 728	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	schtasks.exe
PID 812 wrote to memory of 2780	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	MSBuild.exe
PID 812 wrote to memory of 2780	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	MSBuild.exe
PID 812 wrote to memory of 2780	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	MSBuild.exe
PID 812 wrote to memory of 2780	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	MSBuild.exe
PID 812 wrote to memory of 2780	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	MSBuild.exe
PID 812 wrote to memory of 2780	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	MSBuild.exe
PID 812 wrote to memory of 2780	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	MSBuild.exe
PID 812 wrote to memory of 2780	812	0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe
"C:\Users\Admin\AppData\Local\Temp\0A70A884C4386A12CD5DCB5B8A6DB76F4DEFF1A39CCAA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HGYxBLK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3FA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:728
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3FA.tmp

MD5
d618f1648f5470ee973bf104e3956675

SHA1
ac72137f2a513f3eeb3d36c6d6eb3cb9c1fffcad

SHA256
d379dbb21d4d7c959513280e5828c2a969f751720c2f366b6955cb800c0e655c

SHA512
7726a4d472e4db80b8d8209b2f3c0a55b2403ee1523fbf807de0bb1a0bd8216e97bc013ad78e928daa6dcfaef49f983a31c6dad54ca356cde600fb0d7189bfc9

Download Submit
memory/812-115-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/2780-117-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2780-118-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads