njrat | b017cdb6f137cd3e72e7524470ebf2ff2712cc5f78db58d6eb87b15b4a84184f

Analysis

max time kernel
184s
max time network
187s
platform
windows7_x64
resource
win7-20220331-en
submitted
06/04/2022, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe
Size 2.4MB
Sample220406-bb2xcsfgh2
SHA256 b017cdb6f137cd3e72e7524470ebf2ff2712cc5f78db58d6eb87b15b4a84184f
MD5 79bb3776371472c8a14897893c2c17e3
SHA1 8aa42ff563940254ed39e8397e08bb2a2a91fdd6
SHA512 520b20e965cf72f4dc825f6780a0e0640cc206521acc51c118cb39cba3d619fb74c0dec9f18c0640ecb7c7c707d89615ec54374f732ef237304df985135a756c
MD5 SHA1 SHA512

Score

10^/10

njrat atyuyewsxxcfzsty evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

ATYUYEWSXXCFZSTY

ffy643dfxvtesdyekyg.ddns.net:6060

Mutex

b2f739c5ab91ae9bc1b600536f84a09f

Attributes

reg_key
b2f739c5ab91ae9bc1b600536f84a09f
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 3 IoCs

pid	Process
892	LocalUIRKBqYDWX.exe
832	LocalLsvxfROSgw.exe
2004	WindowsDefender.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2f739c5ab91ae9bc1b600536f84a09f.exe	WindowsDefender.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2f739c5ab91ae9bc1b600536f84a09f.exe	WindowsDefender.exe

Loads dropped DLL 1 IoCs

pid	Process
892	LocalUIRKBqYDWX.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows\CurrentVersion\Run\b2f739c5ab91ae9bc1b600536f84a09f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsDefender.exe\" .."	WindowsDefender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b2f739c5ab91ae9bc1b600536f84a09f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsDefender.exe\" .."	WindowsDefender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	WindowsDefender.exe
Token: 33	2004	WindowsDefender.exe
Token: SeIncBasePriorityPrivilege	2004	WindowsDefender.exe
Token: 33	2004	WindowsDefender.exe
Token: SeIncBasePriorityPrivilege	2004	WindowsDefender.exe
Token: 33	2004	WindowsDefender.exe
Token: SeIncBasePriorityPrivilege	2004	WindowsDefender.exe
Token: 33	2004	WindowsDefender.exe
Token: SeIncBasePriorityPrivilege	2004	WindowsDefender.exe
Token: 33	2004	WindowsDefender.exe
Token: SeIncBasePriorityPrivilege	2004	WindowsDefender.exe
Token: 33	2004	WindowsDefender.exe
Token: SeIncBasePriorityPrivilege	2004	WindowsDefender.exe
Token: 33	2004	WindowsDefender.exe
Token: SeIncBasePriorityPrivilege	2004	WindowsDefender.exe
Token: 33	2004	WindowsDefender.exe
Token: SeIncBasePriorityPrivilege	2004	WindowsDefender.exe
Token: 33	2004	WindowsDefender.exe
Token: SeIncBasePriorityPrivilege	2004	WindowsDefender.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 892	1088	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	28
PID 1088 wrote to memory of 892	1088	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	28
PID 1088 wrote to memory of 892	1088	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	28
PID 1088 wrote to memory of 892	1088	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	28
PID 1088 wrote to memory of 832	1088	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	29
PID 1088 wrote to memory of 832	1088	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	29
PID 1088 wrote to memory of 832	1088	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	29
PID 1088 wrote to memory of 832	1088	B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe	29
PID 892 wrote to memory of 2004	892	LocalUIRKBqYDWX.exe	30
PID 892 wrote to memory of 2004	892	LocalUIRKBqYDWX.exe	30
PID 892 wrote to memory of 2004	892	LocalUIRKBqYDWX.exe	30
PID 892 wrote to memory of 2004	892	LocalUIRKBqYDWX.exe	30
PID 2004 wrote to memory of 1132	2004	WindowsDefender.exe	31
PID 2004 wrote to memory of 1132	2004	WindowsDefender.exe	31
PID 2004 wrote to memory of 1132	2004	WindowsDefender.exe	31
PID 2004 wrote to memory of 1132	2004	WindowsDefender.exe	31

C:\Users\Admin\AppData\Local\Temp\B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe
"C:\Users\Admin\AppData\Local\Temp\B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\LocalUIRKBqYDWX.exe
  "C:\Users\Admin\AppData\LocalUIRKBqYDWX.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe" "WindowsDefender.exe" ENABLE
      4⤵
      PID:1132
- C:\Users\Admin\AppData\LocalLsvxfROSgw.exe
  "C:\Users\Admin\AppData\LocalLsvxfROSgw.exe"
  2⤵
  - Executes dropped EXE
  PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalLsvxfROSgw.exe

Path C:\Users\Admin\AppData\LocalLsvxfROSgw.exe
Size 2.4MB
SHA256 eeaad82c8c57d82cef01f8df384896b3d220b7e651a1e4fbec238cb7aa80eb99
MD5 72bc4ce9e641f25ca4a2cd5beb7ab43d
SHA1 1d1aef7962bd4ef0711ad64718fe12ebe98513ac
SHA512 3a8c87b126da5d9c4fdfb70c7e962ff465ed2e591b3903e8316195006ee82e1911f5baf9e62fc339c714ef7df002c1b2e4972cdbe94d3343c2e6af6a3b05101d
SSDEEP 49152:3hCQGVrh9tSBzKPBc0IQekGPlUXd07t2vM/M:RCQGVftSBePBc0skGPlUXdRUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalLsvxfROSgw.exe

Path C:\Users\Admin\AppData\LocalLsvxfROSgw.exe
Size 2.4MB
SHA256 eeaad82c8c57d82cef01f8df384896b3d220b7e651a1e4fbec238cb7aa80eb99
MD5 72bc4ce9e641f25ca4a2cd5beb7ab43d
SHA1 1d1aef7962bd4ef0711ad64718fe12ebe98513ac
SHA512 3a8c87b126da5d9c4fdfb70c7e962ff465ed2e591b3903e8316195006ee82e1911f5baf9e62fc339c714ef7df002c1b2e4972cdbe94d3343c2e6af6a3b05101d
SSDEEP 49152:3hCQGVrh9tSBzKPBc0IQekGPlUXd07t2vM/M:RCQGVftSBePBc0skGPlUXdRUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalUIRKBqYDWX.exe

Path C:\Users\Admin\AppData\LocalUIRKBqYDWX.exe
Size 23KB
SHA256 9435cfaf83d541afd3776aade5018ebbe8659ad99151edfbe135b29e792538bc
MD5 7dfec5a225dddbeb3d7972cbb145eb43
SHA1 5482ad5b6504f8df6b358c42ae963f53c7006184
SHA512 615256db98d32631b6b6d573a4478618e4256ff954bff5ba489a3bed9561ef33e1b8c49046d8ed129fb289ff19eda6bdfa789a368c390938ccc1bf34ed5a9964
SSDEEP 384:0eop9oS+2pRURIXIRHVSuV+MX9w6Dglo61ZhXDVmRvR6JZlbw8hqIusZzZ3Y:fof9pnIP1VkYRpcnuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalUIRKBqYDWX.exe

Path C:\Users\Admin\AppData\LocalUIRKBqYDWX.exe
Size 23KB
SHA256 9435cfaf83d541afd3776aade5018ebbe8659ad99151edfbe135b29e792538bc
MD5 7dfec5a225dddbeb3d7972cbb145eb43
SHA1 5482ad5b6504f8df6b358c42ae963f53c7006184
SHA512 615256db98d32631b6b6d573a4478618e4256ff954bff5ba489a3bed9561ef33e1b8c49046d8ed129fb289ff19eda6bdfa789a368c390938ccc1bf34ed5a9964
SSDEEP 384:0eop9oS+2pRURIXIRHVSuV+MX9w6Dglo61ZhXDVmRvR6JZlbw8hqIusZzZ3Y:fof9pnIP1VkYRpcnuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsDefender.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
Size 23KB
SHA256 9435cfaf83d541afd3776aade5018ebbe8659ad99151edfbe135b29e792538bc
MD5 7dfec5a225dddbeb3d7972cbb145eb43
SHA1 5482ad5b6504f8df6b358c42ae963f53c7006184
SHA512 615256db98d32631b6b6d573a4478618e4256ff954bff5ba489a3bed9561ef33e1b8c49046d8ed129fb289ff19eda6bdfa789a368c390938ccc1bf34ed5a9964
SSDEEP 384:0eop9oS+2pRURIXIRHVSuV+MX9w6Dglo61ZhXDVmRvR6JZlbw8hqIusZzZ3Y:fof9pnIP1VkYRpcnuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsDefender.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
Size 23KB
SHA256 9435cfaf83d541afd3776aade5018ebbe8659ad99151edfbe135b29e792538bc
MD5 7dfec5a225dddbeb3d7972cbb145eb43
SHA1 5482ad5b6504f8df6b358c42ae963f53c7006184
SHA512 615256db98d32631b6b6d573a4478618e4256ff954bff5ba489a3bed9561ef33e1b8c49046d8ed129fb289ff19eda6bdfa789a368c390938ccc1bf34ed5a9964
SSDEEP 384:0eop9oS+2pRURIXIRHVSuV+MX9w6Dglo61ZhXDVmRvR6JZlbw8hqIusZzZ3Y:fof9pnIP1VkYRpcnuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsDefender.exe

Path \Users\Admin\AppData\Local\Temp\WindowsDefender.exe
Size 23KB
SHA256 9435cfaf83d541afd3776aade5018ebbe8659ad99151edfbe135b29e792538bc
MD5 7dfec5a225dddbeb3d7972cbb145eb43
SHA1 5482ad5b6504f8df6b358c42ae963f53c7006184
SHA512 615256db98d32631b6b6d573a4478618e4256ff954bff5ba489a3bed9561ef33e1b8c49046d8ed129fb289ff19eda6bdfa789a368c390938ccc1bf34ed5a9964
SSDEEP 384:0eop9oS+2pRURIXIRHVSuV+MX9w6Dglo61ZhXDVmRvR6JZlbw8hqIusZzZ3Y:fof9pnIP1VkYRpcnuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/832-61-0x00000000009A0000-0x0000000000C0A000-memory.dmp

Download

memory/832-63-0x0000000005155000-0x0000000005166000-memory.dmp

Download

memory/892-60-0x0000000075591000-0x0000000075593000-memory.dmp

Download

memory/892-62-0x0000000074490000-0x0000000074A3B000-memory.dmp

Download

memory/2004-69-0x0000000074490000-0x0000000074A3B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads