njrat | 60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549

General

Target

60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
Size

113KB
MD5

804ab4cb9903d259120e591ac565e5c0
SHA1

11955010086627d54c94c1172455c71417f0a31d
SHA256

60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549
SHA512

180b4eaf31a94ab689e5c4214f521f88e3fa7c6ca273e2e3ae86f65fa9140d743e8a2a996c441d06df39731b2235d73e59c34dc0cd195214475911f1f73ab528

Score

10^/10

njrat hack trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hack

C2

thec0de-22249.portmap.io:22249

Mutex

ac92d1ea6bee0411dba544616f4313da

Attributes

reg_key
ac92d1ea6bee0411dba544616f4313da
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

1136 server.exe

pid	process
1136	server.exe

Loads dropped DLL 6 IoCs

Processes:

60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exeWerFault.exe

pid	process
1944	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe
560	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe

description	pid	process	target process
PID 1512 set thread context of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

560 1136 WerFault.exe server.exe

pid	pid_target	process	target process
560	1136	WerFault.exe	server.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exeserver.exe

pid	process
1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
1136	server.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exeserver.exe

description	pid	process
Token: SeDebugPrivilege	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
Token: SeDebugPrivilege	1136	server.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exeserver.exe

description	pid	process	target process
PID 1512 wrote to memory of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
PID 1512 wrote to memory of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
PID 1512 wrote to memory of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
PID 1512 wrote to memory of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
PID 1512 wrote to memory of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
PID 1512 wrote to memory of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
PID 1512 wrote to memory of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
PID 1512 wrote to memory of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
PID 1512 wrote to memory of 1944	1512	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
PID 1944 wrote to memory of 1136	1944	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	server.exe
PID 1944 wrote to memory of 1136	1944	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	server.exe
PID 1944 wrote to memory of 1136	1944	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	server.exe
PID 1944 wrote to memory of 1136	1944	60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe	server.exe
PID 1136 wrote to memory of 560	1136	server.exe	WerFault.exe
PID 1136 wrote to memory of 560	1136	server.exe	WerFault.exe
PID 1136 wrote to memory of 560	1136	server.exe	WerFault.exe
PID 1136 wrote to memory of 560	1136	server.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
"C:\Users\Admin\AppData\Local\Temp\60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe
"C:\Users\Admin\AppData\Local\Temp\60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 48868
4⤵
- Loads dropped DLL
- Program crash
PID:560

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
113KB

MD5
804ab4cb9903d259120e591ac565e5c0

SHA1
11955010086627d54c94c1172455c71417f0a31d

SHA256
60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549

SHA512
180b4eaf31a94ab689e5c4214f521f88e3fa7c6ca273e2e3ae86f65fa9140d743e8a2a996c441d06df39731b2235d73e59c34dc0cd195214475911f1f73ab528

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
113KB

MD5
804ab4cb9903d259120e591ac565e5c0

SHA1
11955010086627d54c94c1172455c71417f0a31d

SHA256
60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549

SHA512
180b4eaf31a94ab689e5c4214f521f88e3fa7c6ca273e2e3ae86f65fa9140d743e8a2a996c441d06df39731b2235d73e59c34dc0cd195214475911f1f73ab528

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
113KB

MD5
804ab4cb9903d259120e591ac565e5c0

SHA1
11955010086627d54c94c1172455c71417f0a31d

SHA256
60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549

SHA512
180b4eaf31a94ab689e5c4214f521f88e3fa7c6ca273e2e3ae86f65fa9140d743e8a2a996c441d06df39731b2235d73e59c34dc0cd195214475911f1f73ab528

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
113KB

MD5
804ab4cb9903d259120e591ac565e5c0

SHA1
11955010086627d54c94c1172455c71417f0a31d

SHA256
60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549

SHA512
180b4eaf31a94ab689e5c4214f521f88e3fa7c6ca273e2e3ae86f65fa9140d743e8a2a996c441d06df39731b2235d73e59c34dc0cd195214475911f1f73ab528

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
113KB

MD5
804ab4cb9903d259120e591ac565e5c0

SHA1
11955010086627d54c94c1172455c71417f0a31d

SHA256
60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549

SHA512
180b4eaf31a94ab689e5c4214f521f88e3fa7c6ca273e2e3ae86f65fa9140d743e8a2a996c441d06df39731b2235d73e59c34dc0cd195214475911f1f73ab528

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
113KB

MD5
804ab4cb9903d259120e591ac565e5c0

SHA1
11955010086627d54c94c1172455c71417f0a31d

SHA256
60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549

SHA512
180b4eaf31a94ab689e5c4214f521f88e3fa7c6ca273e2e3ae86f65fa9140d743e8a2a996c441d06df39731b2235d73e59c34dc0cd195214475911f1f73ab528

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
113KB

MD5
804ab4cb9903d259120e591ac565e5c0

SHA1
11955010086627d54c94c1172455c71417f0a31d

SHA256
60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549

SHA512
180b4eaf31a94ab689e5c4214f521f88e3fa7c6ca273e2e3ae86f65fa9140d743e8a2a996c441d06df39731b2235d73e59c34dc0cd195214475911f1f73ab528

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
113KB

MD5
804ab4cb9903d259120e591ac565e5c0

SHA1
11955010086627d54c94c1172455c71417f0a31d

SHA256
60750c9f862c0e8d042d8d7be60e1701c57b2a5da6ff58dca31e54a7a0785549

SHA512
180b4eaf31a94ab689e5c4214f521f88e3fa7c6ca273e2e3ae86f65fa9140d743e8a2a996c441d06df39731b2235d73e59c34dc0cd195214475911f1f73ab528

Download Submit
memory/560-74-0x0000000000000000-mapping.dmp

Download
memory/1136-73-0x00000000000D0000-0x00000000000F4000-memory.dmp

Filesize
144KB

Download
memory/1136-70-0x0000000000000000-mapping.dmp

Download
memory/1512-54-0x0000000000FE0000-0x0000000001004000-memory.dmp

Filesize
144KB

Download
memory/1512-56-0x0000000000210000-0x000000000021A000-memory.dmp

Filesize
40KB

Download
memory/1512-55-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/1944-60-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-68-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download
memory/1944-67-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-65-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-63-0x000000000040749E-mapping.dmp

Download
memory/1944-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-61-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-57-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads