njrat | dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35

General

Target

dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe
Size

37KB
MD5

d188c64010292c6bc14b39300ea1b02c
SHA1

9e528a712b392f06702474754b69dbc5464aa67a
SHA256

dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35
SHA512

a080a35a1013e36c8606d8b9c4536bb7a4ba302999abfd36f05f3f42c97caaa8a2dbb9533ca91521255905c1fd8fbabfb2772299d3f43deefb082969030d453e

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

5a545701cd814ea07365ecbf66477e27

Attributes

reg_key
5a545701cd814ea07365ecbf66477e27
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

1584 server.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Loads dropped DLL 1 IoCs

Processes:

dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe

pid process

1684 dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1584	server.exe

pid	process
1684	dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	1584	server.exe
Token: 33	1584	server.exe
Token: SeIncBasePriorityPrivilege	1584	server.exe
Token: 33	1584	server.exe
Token: SeIncBasePriorityPrivilege	1584	server.exe
Token: 33	1584	server.exe
Token: SeIncBasePriorityPrivilege	1584	server.exe
Token: 33	1584	server.exe
Token: SeIncBasePriorityPrivilege	1584	server.exe
Token: 33	1584	server.exe
Token: SeIncBasePriorityPrivilege	1584	server.exe
Token: 33	1584	server.exe
Token: SeIncBasePriorityPrivilege	1584	server.exe
Token: 33	1584	server.exe
Token: SeIncBasePriorityPrivilege	1584	server.exe
Token: 33	1584	server.exe
Token: SeIncBasePriorityPrivilege	1584	server.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exeserver.exe

description	pid	process	target process
PID 1684 wrote to memory of 1584	1684	dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe	server.exe
PID 1684 wrote to memory of 1584	1684	dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe	server.exe
PID 1684 wrote to memory of 1584	1684	dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe	server.exe
PID 1684 wrote to memory of 1584	1684	dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe	server.exe
PID 1584 wrote to memory of 1528	1584	server.exe	netsh.exe
PID 1584 wrote to memory of 1528	1584	server.exe	netsh.exe
PID 1584 wrote to memory of 1528	1584	server.exe	netsh.exe
PID 1584 wrote to memory of 1528	1584	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe
"C:\Users\Admin\AppData\Local\Temp\dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Roaming\server.exe
"C:\Users\Admin\AppData\Roaming\server.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
3⤵
PID:1528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\server.exe
Filesize
37KB

MD5
d188c64010292c6bc14b39300ea1b02c

SHA1
9e528a712b392f06702474754b69dbc5464aa67a

SHA256
dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35

SHA512
a080a35a1013e36c8606d8b9c4536bb7a4ba302999abfd36f05f3f42c97caaa8a2dbb9533ca91521255905c1fd8fbabfb2772299d3f43deefb082969030d453e

Download Submit
C:\Users\Admin\AppData\Roaming\server.exe
Filesize
37KB

MD5
d188c64010292c6bc14b39300ea1b02c

SHA1
9e528a712b392f06702474754b69dbc5464aa67a

SHA256
dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35

SHA512
a080a35a1013e36c8606d8b9c4536bb7a4ba302999abfd36f05f3f42c97caaa8a2dbb9533ca91521255905c1fd8fbabfb2772299d3f43deefb082969030d453e

Download Submit
\Users\Admin\AppData\Roaming\server.exe
Filesize
37KB

MD5
d188c64010292c6bc14b39300ea1b02c

SHA1
9e528a712b392f06702474754b69dbc5464aa67a

SHA256
dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35

SHA512
a080a35a1013e36c8606d8b9c4536bb7a4ba302999abfd36f05f3f42c97caaa8a2dbb9533ca91521255905c1fd8fbabfb2772299d3f43deefb082969030d453e

Download Submit
memory/1528-62-0x0000000000000000-mapping.dmp

Download
memory/1584-57-0x0000000000000000-mapping.dmp

Download
memory/1584-61-0x0000000073FB0000-0x000000007455B000-memory.dmp

Filesize
5.7MB

Download
memory/1684-54-0x0000000074F91000-0x0000000074F93000-memory.dmp

Filesize
8KB

Download
memory/1684-55-0x0000000073FB0000-0x000000007455B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing