njrat | dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35

General

Target

dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe
Size

37KB
MD5

d188c64010292c6bc14b39300ea1b02c
SHA1

9e528a712b392f06702474754b69dbc5464aa67a
SHA256

dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35
SHA512

a080a35a1013e36c8606d8b9c4536bb7a4ba302999abfd36f05f3f42c97caaa8a2dbb9533ca91521255905c1fd8fbabfb2772299d3f43deefb082969030d453e

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

5a545701cd814ea07365ecbf66477e27

Attributes

reg_key
5a545701cd814ea07365ecbf66477e27
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

4248 server.exe

pid	process
4248	server.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

dw20.exe

description	pid	process
Token: SeRestorePrivilege	3704	dw20.exe
Token: SeBackupPrivilege	3704	dw20.exe
Token: SeBackupPrivilege	3704	dw20.exe
Token: SeBackupPrivilege	3704	dw20.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exeserver.exe

description	pid	process	target process
PID 2256 wrote to memory of 4248	2256	dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe	server.exe
PID 2256 wrote to memory of 4248	2256	dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe	server.exe
PID 2256 wrote to memory of 4248	2256	dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe	server.exe
PID 4248 wrote to memory of 3704	4248	server.exe	dw20.exe
PID 4248 wrote to memory of 3704	4248	server.exe	dw20.exe
PID 4248 wrote to memory of 3704	4248	server.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe
"C:\Users\Admin\AppData\Local\Temp\dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2256

C:\Users\Admin\AppData\Roaming\server.exe
"C:\Users\Admin\AppData\Roaming\server.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 508
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3704

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\server.exe
Filesize
37KB

MD5
d188c64010292c6bc14b39300ea1b02c

SHA1
9e528a712b392f06702474754b69dbc5464aa67a

SHA256
dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35

SHA512
a080a35a1013e36c8606d8b9c4536bb7a4ba302999abfd36f05f3f42c97caaa8a2dbb9533ca91521255905c1fd8fbabfb2772299d3f43deefb082969030d453e

Download Submit
C:\Users\Admin\AppData\Roaming\server.exe
Filesize
37KB

MD5
d188c64010292c6bc14b39300ea1b02c

SHA1
9e528a712b392f06702474754b69dbc5464aa67a

SHA256
dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35

SHA512
a080a35a1013e36c8606d8b9c4536bb7a4ba302999abfd36f05f3f42c97caaa8a2dbb9533ca91521255905c1fd8fbabfb2772299d3f43deefb082969030d453e

Download Submit
memory/2256-130-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/3704-135-0x0000000000000000-mapping.dmp

Download
memory/4248-131-0x0000000000000000-mapping.dmp

Download
memory/4248-134-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads