njrat | c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba

General

Target

c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe
Size

37KB
MD5

91dfd564f2e872a5c9160c223c0bf9ed
SHA1

b4830749827a09131fc6ff32aa0e6ab34dbc4512
SHA256

c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba
SHA512

c18eb99721a3800aae9b6daaf84c55e3fb4b889d412a04a389799616e219cbd94e4a5c54e309632ea630b6c829f7f2d1ca8be09d7318e8914a610e777d887a28

Score

10^/10

njrat sql server evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

SQL server

C2

iferuss.ddns.net:5454

Mutex

13f4da54eb6bdd00f81e5dd87548c94f

Attributes

reg_key
13f4da54eb6bdd00f81e5dd87548c94f
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

964 svchost.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Loads dropped DLL 1 IoCs

Processes:

c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe

pid process

1652 c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
964	svchost.exe

pid	process
1652	c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	964	svchost.exe
Token: 33	964	svchost.exe
Token: SeIncBasePriorityPrivilege	964	svchost.exe
Token: 33	964	svchost.exe
Token: SeIncBasePriorityPrivilege	964	svchost.exe
Token: 33	964	svchost.exe
Token: SeIncBasePriorityPrivilege	964	svchost.exe
Token: 33	964	svchost.exe
Token: SeIncBasePriorityPrivilege	964	svchost.exe
Token: 33	964	svchost.exe
Token: SeIncBasePriorityPrivilege	964	svchost.exe
Token: 33	964	svchost.exe
Token: SeIncBasePriorityPrivilege	964	svchost.exe
Token: 33	964	svchost.exe
Token: SeIncBasePriorityPrivilege	964	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exesvchost.exe

description	pid	process	target process
PID 1652 wrote to memory of 964	1652	c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe	svchost.exe
PID 1652 wrote to memory of 964	1652	c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe	svchost.exe
PID 1652 wrote to memory of 964	1652	c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe	svchost.exe
PID 1652 wrote to memory of 964	1652	c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe	svchost.exe
PID 964 wrote to memory of 1784	964	svchost.exe	netsh.exe
PID 964 wrote to memory of 1784	964	svchost.exe	netsh.exe
PID 964 wrote to memory of 1784	964	svchost.exe	netsh.exe
PID 964 wrote to memory of 1784	964	svchost.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe
"C:\Users\Admin\AppData\Local\Temp\c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
3⤵
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
37KB

MD5
91dfd564f2e872a5c9160c223c0bf9ed

SHA1
b4830749827a09131fc6ff32aa0e6ab34dbc4512

SHA256
c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba

SHA512
c18eb99721a3800aae9b6daaf84c55e3fb4b889d412a04a389799616e219cbd94e4a5c54e309632ea630b6c829f7f2d1ca8be09d7318e8914a610e777d887a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
37KB

MD5
91dfd564f2e872a5c9160c223c0bf9ed

SHA1
b4830749827a09131fc6ff32aa0e6ab34dbc4512

SHA256
c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba

SHA512
c18eb99721a3800aae9b6daaf84c55e3fb4b889d412a04a389799616e219cbd94e4a5c54e309632ea630b6c829f7f2d1ca8be09d7318e8914a610e777d887a28

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
37KB

MD5
91dfd564f2e872a5c9160c223c0bf9ed

SHA1
b4830749827a09131fc6ff32aa0e6ab34dbc4512

SHA256
c7acd87f5b38a5e6d6ba52955d47e004a9492f14b1f7b07fded8aaff6deac8ba

SHA512
c18eb99721a3800aae9b6daaf84c55e3fb4b889d412a04a389799616e219cbd94e4a5c54e309632ea630b6c829f7f2d1ca8be09d7318e8914a610e777d887a28

Download Submit
memory/964-57-0x0000000000000000-mapping.dmp

Download
memory/964-61-0x0000000074140000-0x00000000746EB000-memory.dmp

Filesize
5.7MB

Download
memory/1652-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x0000000074140000-0x00000000746EB000-memory.dmp

Filesize
5.7MB

Download
memory/1784-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing