Overview

overview

10

Static

static

10

6778bc6fb0...96.exe

windows7_x64

10

6778bc6fb0...96.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    19-04-2022 12:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6778bc6fb029be25f1922c082048f5222af258a183ba724b0df05225e2f2c196.exe

  • Size

    93KB

  • MD5

    c9dd2cbc4594e47a4760157ab894bd52

  • SHA1

    d48c7b811eb73c5f921fe870fe3ff6b4f75b9a9e

  • SHA256

    6778bc6fb029be25f1922c082048f5222af258a183ba724b0df05225e2f2c196

  • SHA512

    99bcb76a5b90aeaf15ed330b7b0c8ff5ffcc65029fcba69f4c8f9f4a2db9223f98819b3661c09641097f626f7ef801267a9a829484d731b19eafd7a1faa12a07

Score
10/10
njrathackerevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hacker

C2

FRANSESCOTI3LjAuFRANSESCOC4x:MTYwNA==

Mutex

dfd6ed83b13338db2ca4f209d9a7474f

Attributes
  • reg_key

    dfd6ed83b13338db2ca4f209d9a7474f

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6778bc6fb029be25f1922c082048f5222af258a183ba724b0df05225e2f2c196.exe
    "C:\Users\Admin\AppData\Local\Temp\6778bc6fb029be25f1922c082048f5222af258a183ba724b0df05225e2f2c196.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Users\Admin\AppData\Roaming\server.exe
      "C:\Users\Admin\AppData\Roaming\server.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
        3⤵
          PID:3060
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
          3⤵
            PID:4416
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
            3⤵
              PID:4632

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Modify Existing Service

        1
        T1031

        Privilege Escalation

        Defense Evasion

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\app
          Filesize

          5B

          MD5

          2099bb64fd1770d321df364f99b658d1

          SHA1

          3124edeaa14c060becfa8b980ed77db15d56a9e3

          SHA256

          d53ce6bdbd0c3cb4596ac3103f15824570a9858da95f63cedf64cec11dc44e2d

          SHA512

          3481f2a02f7b1255ad0f3cd8a716de9c7414753b6f8657f0bf99738ff6623f8717469bc10e737d6c0d1d13846e726d50baeb5e8ef73efcfce7be5c63327c4895

          Download Submit
        • C:\Users\Admin\AppData\Roaming\server.exe
          Filesize

          93KB

          MD5

          c9dd2cbc4594e47a4760157ab894bd52

          SHA1

          d48c7b811eb73c5f921fe870fe3ff6b4f75b9a9e

          SHA256

          6778bc6fb029be25f1922c082048f5222af258a183ba724b0df05225e2f2c196

          SHA512

          99bcb76a5b90aeaf15ed330b7b0c8ff5ffcc65029fcba69f4c8f9f4a2db9223f98819b3661c09641097f626f7ef801267a9a829484d731b19eafd7a1faa12a07

          Download Submit
        • C:\Users\Admin\AppData\Roaming\server.exe
          Filesize

          93KB

          MD5

          c9dd2cbc4594e47a4760157ab894bd52

          SHA1

          d48c7b811eb73c5f921fe870fe3ff6b4f75b9a9e

          SHA256

          6778bc6fb029be25f1922c082048f5222af258a183ba724b0df05225e2f2c196

          SHA512

          99bcb76a5b90aeaf15ed330b7b0c8ff5ffcc65029fcba69f4c8f9f4a2db9223f98819b3661c09641097f626f7ef801267a9a829484d731b19eafd7a1faa12a07

          Download Submit
        • memory/1252-131-0x0000000000000000-mapping.dmp
          Download
        • memory/1252-135-0x00000000753E0000-0x0000000075991000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/3060-136-0x0000000000000000-mapping.dmp
          Download
        • memory/4416-137-0x0000000000000000-mapping.dmp
          Download
        • memory/4632-138-0x0000000000000000-mapping.dmp
          Download
        • memory/4956-130-0x00000000753E0000-0x0000000075991000-memory.dmp
          Filesize

          5.7MB

          Download