njrat | 72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616

General

Target

72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe
Size

32KB
MD5

216832fb0d4a2660207d1d3129d3df9e
SHA1

909235013e83dad057fedc4ce3d4a64ac3dbd88c
SHA256

72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616
SHA512

054f69b044a8192663720927e5e46dad0199a30164b0a595dab0a1da9e6d9019c20bcfba2c43e6cb01de397d18698a6aa5aa67bc3faa3db598658753ad5821f3

Score

10^/10

njrat hacked by hidden person evasion persistence trojan

Malware Config

Extracted

Family

njrat

Botnet

Hacked By HiDDen PerSOn

Mutex

3a7cf98516f6e8ccf3f592aaa4ca5cb5

Attributes

reg_key
3a7cf98516f6e8ccf3f592aaa4ca5cb5

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

668 svchost.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
668	svchost.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3a7cf98516f6e8ccf3f592aaa4ca5cb5.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3a7cf98516f6e8ccf3f592aaa4ca5cb5.exe	svchost.exe

Loads dropped DLL 1 IoCs

Processes:

72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe

pid process

1728 72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe

pid	process
1728	72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\3a7cf98516f6e8ccf3f592aaa4ca5cb5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\3a7cf98516f6e8ccf3f592aaa4ca5cb5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe
Token: 33	668	svchost.exe
Token: SeIncBasePriorityPrivilege	668	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exesvchost.exe

description	pid	process	target process
PID 1728 wrote to memory of 668	1728	72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe	svchost.exe
PID 1728 wrote to memory of 668	1728	72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe	svchost.exe
PID 1728 wrote to memory of 668	1728	72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe	svchost.exe
PID 1728 wrote to memory of 668	1728	72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe	svchost.exe
PID 668 wrote to memory of 1980	668	svchost.exe	netsh.exe
PID 668 wrote to memory of 1980	668	svchost.exe	netsh.exe
PID 668 wrote to memory of 1980	668	svchost.exe	netsh.exe
PID 668 wrote to memory of 1980	668	svchost.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe
"C:\Users\Admin\AppData\Local\Temp\72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
3⤵
PID:1980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchost.exe
MD5
216832fb0d4a2660207d1d3129d3df9e

SHA1
909235013e83dad057fedc4ce3d4a64ac3dbd88c

SHA256
72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616

SHA512
054f69b044a8192663720927e5e46dad0199a30164b0a595dab0a1da9e6d9019c20bcfba2c43e6cb01de397d18698a6aa5aa67bc3faa3db598658753ad5821f3

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
MD5
216832fb0d4a2660207d1d3129d3df9e

SHA1
909235013e83dad057fedc4ce3d4a64ac3dbd88c

SHA256
72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616

SHA512
054f69b044a8192663720927e5e46dad0199a30164b0a595dab0a1da9e6d9019c20bcfba2c43e6cb01de397d18698a6aa5aa67bc3faa3db598658753ad5821f3

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe
MD5
216832fb0d4a2660207d1d3129d3df9e

SHA1
909235013e83dad057fedc4ce3d4a64ac3dbd88c

SHA256
72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616

SHA512
054f69b044a8192663720927e5e46dad0199a30164b0a595dab0a1da9e6d9019c20bcfba2c43e6cb01de397d18698a6aa5aa67bc3faa3db598658753ad5821f3

Download Submit
memory/668-61-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/1728-55-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download
memory/1728-56-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads