njrat | 94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae

General

Target

94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe
Size

31KB
MD5

9d133a0834ae64b62ee98388ea870a02
SHA1

0d9bcb4560c22e36d304ca23c1b2bff757dd4ee0
SHA256

94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae
SHA512

5e95130a3b7f2de70a346b87dcca04a21b800efe5c2bb570b7affc61acd8009e363ba328354ff17fa48807fb739610bf79cea0cdd3e770dc90da64b3b3c2a3b8

Score

10^/10

njrat username evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

username

C2

helpmepls123.ddns.net:6522

Mutex

997fb9a584520c7d72161d82bec2816f

Attributes

reg_key
997fb9a584520c7d72161d82bec2816f
splitter
Y262SUCZ4UJJ

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

drivermvi.exe

pid process

840 drivermvi.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
840	drivermvi.exe

Drops startup file 2 IoCs

Processes:

drivermvi.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\997fb9a584520c7d72161d82bec2816f.exe	drivermvi.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\997fb9a584520c7d72161d82bec2816f.exe	drivermvi.exe

Loads dropped DLL 1 IoCs

Processes:

94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe

pid process

1472 94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe

pid	process
1472	94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

drivermvi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\997fb9a584520c7d72161d82bec2816f = "\"C:\\Users\\Admin\\AppData\\Roaming\\drivermvi.exe\" .."	drivermvi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\997fb9a584520c7d72161d82bec2816f = "\"C:\\Users\\Admin\\AppData\\Roaming\\drivermvi.exe\" .."	drivermvi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

drivermvi.exe

description	pid	process
Token: SeDebugPrivilege	840	drivermvi.exe
Token: 33	840	drivermvi.exe
Token: SeIncBasePriorityPrivilege	840	drivermvi.exe
Token: 33	840	drivermvi.exe
Token: SeIncBasePriorityPrivilege	840	drivermvi.exe
Token: 33	840	drivermvi.exe
Token: SeIncBasePriorityPrivilege	840	drivermvi.exe
Token: 33	840	drivermvi.exe
Token: SeIncBasePriorityPrivilege	840	drivermvi.exe
Token: 33	840	drivermvi.exe
Token: SeIncBasePriorityPrivilege	840	drivermvi.exe
Token: 33	840	drivermvi.exe
Token: SeIncBasePriorityPrivilege	840	drivermvi.exe
Token: 33	840	drivermvi.exe
Token: SeIncBasePriorityPrivilege	840	drivermvi.exe
Token: 33	840	drivermvi.exe
Token: SeIncBasePriorityPrivilege	840	drivermvi.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exedrivermvi.exe

description	pid	process	target process
PID 1472 wrote to memory of 840	1472	94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe	drivermvi.exe
PID 1472 wrote to memory of 840	1472	94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe	drivermvi.exe
PID 1472 wrote to memory of 840	1472	94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe	drivermvi.exe
PID 1472 wrote to memory of 840	1472	94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe	drivermvi.exe
PID 840 wrote to memory of 1836	840	drivermvi.exe	netsh.exe
PID 840 wrote to memory of 1836	840	drivermvi.exe	netsh.exe
PID 840 wrote to memory of 1836	840	drivermvi.exe	netsh.exe
PID 840 wrote to memory of 1836	840	drivermvi.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe
"C:\Users\Admin\AppData\Local\Temp\94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472

C:\Users\Admin\AppData\Roaming\drivermvi.exe
"C:\Users\Admin\AppData\Roaming\drivermvi.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\drivermvi.exe" "drivermvi.exe" ENABLE
3⤵
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\drivermvi.exe
Filesize
31KB

MD5
9d133a0834ae64b62ee98388ea870a02

SHA1
0d9bcb4560c22e36d304ca23c1b2bff757dd4ee0

SHA256
94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae

SHA512
5e95130a3b7f2de70a346b87dcca04a21b800efe5c2bb570b7affc61acd8009e363ba328354ff17fa48807fb739610bf79cea0cdd3e770dc90da64b3b3c2a3b8

Download Submit
C:\Users\Admin\AppData\Roaming\drivermvi.exe
Filesize
31KB

MD5
9d133a0834ae64b62ee98388ea870a02

SHA1
0d9bcb4560c22e36d304ca23c1b2bff757dd4ee0

SHA256
94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae

SHA512
5e95130a3b7f2de70a346b87dcca04a21b800efe5c2bb570b7affc61acd8009e363ba328354ff17fa48807fb739610bf79cea0cdd3e770dc90da64b3b3c2a3b8

Download Submit
\Users\Admin\AppData\Roaming\drivermvi.exe
Filesize
31KB

MD5
9d133a0834ae64b62ee98388ea870a02

SHA1
0d9bcb4560c22e36d304ca23c1b2bff757dd4ee0

SHA256
94ddab9bf418a816979e7e1ad9dc43c71c00923c5f8f1ff80523e90f6c6947ae

SHA512
5e95130a3b7f2de70a346b87dcca04a21b800efe5c2bb570b7affc61acd8009e363ba328354ff17fa48807fb739610bf79cea0cdd3e770dc90da64b3b3c2a3b8

Download Submit
memory/840-57-0x0000000000000000-mapping.dmp

Download
memory/840-61-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1472-54-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/1472-55-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1836-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads