njrat | bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555

General

Target

bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe
Size

373KB
MD5

742e33685f0b3257ac192e7b6695c8f5
SHA1

a3043a63883165298b6c62a44a9aeb6c3d27b762
SHA256

bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555
SHA512

4410f522f0c626f409ab0a919562e3dd64f66ce0c3272c89a44cf4c99fe486ab2f5c2820eb8776d34d3e4ac985f5366a682980e0cdf6f9bff15c966b7c952c19

Score

10^/10

njrat lime link pdf suricata trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Lime

C2

soportesltda30.duckdns.org:4433

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
jairpicc

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Executes dropped EXE 3 IoCs

Processes:

windows.exewindows.exewindows.exe

pid process

672 windows.exe
1620 windows.exe
1116 windows.exe
Drops startup file 1 IoCs

Processes:

WScript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.EXE WScript.exe
Loads dropped DLL 1 IoCs

Processes:

WScript.exe

pid process

964 WScript.exe

pid	process
672	windows.exe
1620	windows.exe
1116	windows.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.EXE	WScript.exe

pid	process
964	WScript.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\leer.pdf	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1776 schtasks.exe
1608 schtasks.exe
560 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1560 AcroRd32.exe

pid	process
1776	schtasks.exe
1608	schtasks.exe
560	schtasks.exe

pid	process
1560	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

windows.exe

description	pid	process
Token: SeDebugPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe
Token: 33	672	windows.exe
Token: SeIncBasePriorityPrivilege	672	windows.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1560 AcroRd32.exe
1560 AcroRd32.exe
1560 AcroRd32.exe
1560 AcroRd32.exe

pid	process
1560	AcroRd32.exe
1560	AcroRd32.exe
1560	AcroRd32.exe
1560	AcroRd32.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exeWScript.exewindows.exetaskeng.exewindows.exewindows.exe

description	pid	process	target process
PID 1532 wrote to memory of 1560	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	AcroRd32.exe
PID 1532 wrote to memory of 1560	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	AcroRd32.exe
PID 1532 wrote to memory of 1560	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	AcroRd32.exe
PID 1532 wrote to memory of 1560	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	AcroRd32.exe
PID 1532 wrote to memory of 1560	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	AcroRd32.exe
PID 1532 wrote to memory of 1560	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	AcroRd32.exe
PID 1532 wrote to memory of 1560	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	AcroRd32.exe
PID 1532 wrote to memory of 964	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	WScript.exe
PID 1532 wrote to memory of 964	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	WScript.exe
PID 1532 wrote to memory of 964	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	WScript.exe
PID 1532 wrote to memory of 964	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	WScript.exe
PID 1532 wrote to memory of 964	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	WScript.exe
PID 1532 wrote to memory of 964	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	WScript.exe
PID 1532 wrote to memory of 964	1532	bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe	WScript.exe
PID 964 wrote to memory of 672	964	WScript.exe	windows.exe
PID 964 wrote to memory of 672	964	WScript.exe	windows.exe
PID 964 wrote to memory of 672	964	WScript.exe	windows.exe
PID 964 wrote to memory of 672	964	WScript.exe	windows.exe
PID 964 wrote to memory of 672	964	WScript.exe	windows.exe
PID 964 wrote to memory of 672	964	WScript.exe	windows.exe
PID 964 wrote to memory of 672	964	WScript.exe	windows.exe
PID 672 wrote to memory of 1368	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1368	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1368	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1368	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1368	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1368	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1368	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1776	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1776	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1776	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1776	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1776	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1776	672	windows.exe	schtasks.exe
PID 672 wrote to memory of 1776	672	windows.exe	schtasks.exe
PID 1740 wrote to memory of 1620	1740	taskeng.exe	windows.exe
PID 1740 wrote to memory of 1620	1740	taskeng.exe	windows.exe
PID 1740 wrote to memory of 1620	1740	taskeng.exe	windows.exe
PID 1740 wrote to memory of 1620	1740	taskeng.exe	windows.exe
PID 1620 wrote to memory of 1604	1620	windows.exe	schtasks.exe
PID 1620 wrote to memory of 1604	1620	windows.exe	schtasks.exe
PID 1620 wrote to memory of 1604	1620	windows.exe	schtasks.exe
PID 1620 wrote to memory of 1604	1620	windows.exe	schtasks.exe
PID 1620 wrote to memory of 1608	1620	windows.exe	schtasks.exe
PID 1620 wrote to memory of 1608	1620	windows.exe	schtasks.exe
PID 1620 wrote to memory of 1608	1620	windows.exe	schtasks.exe
PID 1620 wrote to memory of 1608	1620	windows.exe	schtasks.exe
PID 1740 wrote to memory of 1116	1740	taskeng.exe	windows.exe
PID 1740 wrote to memory of 1116	1740	taskeng.exe	windows.exe
PID 1740 wrote to memory of 1116	1740	taskeng.exe	windows.exe
PID 1740 wrote to memory of 1116	1740	taskeng.exe	windows.exe
PID 1116 wrote to memory of 1660	1116	windows.exe	schtasks.exe
PID 1116 wrote to memory of 1660	1116	windows.exe	schtasks.exe
PID 1116 wrote to memory of 1660	1116	windows.exe	schtasks.exe
PID 1116 wrote to memory of 1660	1116	windows.exe	schtasks.exe
PID 1116 wrote to memory of 560	1116	windows.exe	schtasks.exe
PID 1116 wrote to memory of 560	1116	windows.exe	schtasks.exe
PID 1116 wrote to memory of 560	1116	windows.exe	schtasks.exe
PID 1116 wrote to memory of 560	1116	windows.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe
"C:\Users\Admin\AppData\Local\Temp\bd46f270801c9d49f3075005afeec82600948c8d9794e70baad67050f2ace555.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\leer.pdf"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1560

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\win.vbs"
2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:964

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
4⤵
PID:1368

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\windows.exe" /sc minute /mo 1
4⤵
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\taskeng.exe
taskeng.exe {290E7550-C227-4995-8964-FA3EBD25376F} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Users\Admin\AppData\Local\Temp\windows.exe
C:\Users\Admin\AppData\Local\Temp\windows.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
3⤵
PID:1604

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\windows.exe" /sc minute /mo 1
3⤵
- Creates scheduled task(s)
PID:1608

C:\Users\Admin\AppData\Local\Temp\windows.exe
C:\Users\Admin\AppData\Local\Temp\windows.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
3⤵
PID:1660

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\windows.exe" /sc minute /mo 1
3⤵
- Creates scheduled task(s)
PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\leer.pdf
MD5
1db6b198366804e52fa1fbc3599934bf

SHA1
171b5758a6483ce5ccddfc3d5dc5e9d40c7aa7b1

SHA256
60205229cab8dce06632c2b9d61b0628186e74ff6fc7db66112d149a576ec8dc

SHA512
35631ecaf2124ee272f78e6382dc4b8f939ff8fe4b11f874176e44d20526b524b3540d5bf7fd2e21c81e92a69f7f31257e5f1ea1cf9f7e79ba01fd2a7f77efed

Download Submit
C:\Users\Admin\AppData\Local\Temp\win.vbs
MD5
466373d5f9d9e8daa9052c303071080f

SHA1
410d62f9075cae08e6b31c5e666f67892982a6ba

SHA256
f4056dbe3779c8e0700567ed46b782ddc7bfda547e7e63b43d2748ef60e12c12

SHA512
de1eca6b8f17980d44ed5c4de455a78865bc117cf51b02e9e1f026096d417e6593272aa64f45fb8f2657b646608b84df25842b2a5b9b45cda4b2e55bc3e0a303

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
memory/672-64-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/1116-72-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/1532-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1620-69-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads