njrat | 9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60

General

Target

9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe
Size

5.3MB
MD5

aae3c28cbe57932f7916d0a9d7db6baa
SHA1

55e6340e67dec2470dd61a7fb235636ed813623c
SHA256

9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60
SHA512

4cde79d3b953fe5e768c1d7b9acd90242e01add92c654ac8a63b9fa6e199169b715786c4a917fe3624ae0b10340918d9b83a1f7f69a75b79cf62e85bd9df72dc

Score

10^/10

njrat windows evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Windows

C2

195.123.210.61:3003

Mutex

ede277fb5affe7dc0052cadbd3bda25a

Attributes

reg_key
ede277fb5affe7dc0052cadbd3bda25a
splitter
Y262SUCZ4UJJ

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

Client.exed.exeWindowsService.exe

pid process

2088 Client.exe
2400 d.exe
1476 WindowsService.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exeClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Client.exe

Drops startup file 2 IoCs

Processes:

WindowsService.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ede277fb5affe7dc0052cadbd3bda25a.exe	WindowsService.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ede277fb5affe7dc0052cadbd3bda25a.exe	WindowsService.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WindowsService.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ede277fb5affe7dc0052cadbd3bda25a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsService.exe\" .."	WindowsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ede277fb5affe7dc0052cadbd3bda25a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsService.exe\" .."	WindowsService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Client.exe

pid	process
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe
2088	Client.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

Client.exeWindowsService.exe

description	pid	process
Token: SeDebugPrivilege	2088	Client.exe
Token: SeDebugPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe
Token: 33	1476	WindowsService.exe
Token: SeIncBasePriorityPrivilege	1476	WindowsService.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d.exe

pid process

2400 d.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

d.exe

pid process

2400 d.exe

pid	process
2400	d.exe

pid	process
2400	d.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exeClient.exeWindowsService.exe

description	pid	process	target process
PID 4760 wrote to memory of 2088	4760	9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe	Client.exe
PID 4760 wrote to memory of 2088	4760	9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe	Client.exe
PID 4760 wrote to memory of 2088	4760	9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe	Client.exe
PID 4760 wrote to memory of 2400	4760	9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe	d.exe
PID 4760 wrote to memory of 2400	4760	9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe	d.exe
PID 4760 wrote to memory of 2400	4760	9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe	d.exe
PID 2088 wrote to memory of 1476	2088	Client.exe	WindowsService.exe
PID 2088 wrote to memory of 1476	2088	Client.exe	WindowsService.exe
PID 2088 wrote to memory of 1476	2088	Client.exe	WindowsService.exe
PID 1476 wrote to memory of 4484	1476	WindowsService.exe	netsh.exe
PID 1476 wrote to memory of 4484	1476	WindowsService.exe	netsh.exe
PID 1476 wrote to memory of 4484	1476	WindowsService.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe
"C:\Users\Admin\AppData\Local\Temp\9a4ec6b06682a36705365f027947859f0ae5b5883bc31dc0460f224f2501fb60.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\AppData\Local\Temp\WindowsService.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsService.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsService.exe" "WindowsService.exe" ENABLE
4⤵
PID:4484

C:\Users\Admin\AppData\Local\Temp\d.exe
"C:\Users\Admin\AppData\Local\Temp\d.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2400

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Client.exe
Filesize
31KB

MD5
7eb85491f79a9bf8fcb175ad7fba546a

SHA1
59b81367a87b2ece4473e3acb974e440d82f12c1

SHA256
fb289eb564e9ade777a3a92fbcdb01d89518741336d843746bff246e16f06f73

SHA512
377dbef52d80f6a29a5d2eff9cfd1ca99f7ae3d1f81bea327dcbaac552d0b8bfd4159bc3e2b19d3c034ae6ec737711db700e0cd547286c3be2bb629242fa2486

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe
Filesize
31KB

MD5
7eb85491f79a9bf8fcb175ad7fba546a

SHA1
59b81367a87b2ece4473e3acb974e440d82f12c1

SHA256
fb289eb564e9ade777a3a92fbcdb01d89518741336d843746bff246e16f06f73

SHA512
377dbef52d80f6a29a5d2eff9cfd1ca99f7ae3d1f81bea327dcbaac552d0b8bfd4159bc3e2b19d3c034ae6ec737711db700e0cd547286c3be2bb629242fa2486

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsService.exe
Filesize
31KB

MD5
7eb85491f79a9bf8fcb175ad7fba546a

SHA1
59b81367a87b2ece4473e3acb974e440d82f12c1

SHA256
fb289eb564e9ade777a3a92fbcdb01d89518741336d843746bff246e16f06f73

SHA512
377dbef52d80f6a29a5d2eff9cfd1ca99f7ae3d1f81bea327dcbaac552d0b8bfd4159bc3e2b19d3c034ae6ec737711db700e0cd547286c3be2bb629242fa2486

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsService.exe
Filesize
31KB

MD5
7eb85491f79a9bf8fcb175ad7fba546a

SHA1
59b81367a87b2ece4473e3acb974e440d82f12c1

SHA256
fb289eb564e9ade777a3a92fbcdb01d89518741336d843746bff246e16f06f73

SHA512
377dbef52d80f6a29a5d2eff9cfd1ca99f7ae3d1f81bea327dcbaac552d0b8bfd4159bc3e2b19d3c034ae6ec737711db700e0cd547286c3be2bb629242fa2486

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.exe
Filesize
8.5MB

MD5
70ea9c044c9a766330d3fe77418244a5

SHA1
18602d0db52917b88cbdab84ba89181e6fd4686a

SHA256
b78fb092e151db613cba51d7f2532547e48c6f4712809a485f272e2ab55776a5

SHA512
5261865e7ca21e928b956a97518366c9dc218a2312961e0ba0b72b37ae7c797176382de3c3dc1d2949aca51c3db330562f1087a71efdc7c3c3b8f8928872f917

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.exe
Filesize
8.5MB

MD5
70ea9c044c9a766330d3fe77418244a5

SHA1
18602d0db52917b88cbdab84ba89181e6fd4686a

SHA256
b78fb092e151db613cba51d7f2532547e48c6f4712809a485f272e2ab55776a5

SHA512
5261865e7ca21e928b956a97518366c9dc218a2312961e0ba0b72b37ae7c797176382de3c3dc1d2949aca51c3db330562f1087a71efdc7c3c3b8f8928872f917

Download Submit
memory/1476-138-0x0000000000000000-mapping.dmp

Download
memory/1476-141-0x0000000073CD0000-0x0000000074281000-memory.dmp

Filesize
5.7MB

Download
memory/2088-136-0x0000000073CD0000-0x0000000074281000-memory.dmp

Filesize
5.7MB

Download
memory/2088-130-0x0000000000000000-mapping.dmp

Download
memory/2400-137-0x0000000073CD0000-0x0000000074281000-memory.dmp

Filesize
5.7MB

Download
memory/2400-133-0x0000000000000000-mapping.dmp

Download
memory/4484-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads