njrat | 803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3

General

Target

803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3.exe
Size

25KB
MD5

6885b91d3e5c45fd2055477d11803f9c
SHA1

3ba4c6210e6354a3d12b9a28ec0d3132d75bb286
SHA256

803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3
SHA512

ef6989687d71736de385b6d162d92e8ea172fe4b4596e57532652425701bbdc48523e5bb418e39a7873f131d94235b6d505d9cfe32c8c484c6e9b4e1d603ad4a

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1272 AcroRd32.exe
1272 AcroRd32.exe
1272 AcroRd32.exe

pid	process
1272	AcroRd32.exe
1272	AcroRd32.exe
1272	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3.exerundll32.exe

description	pid	process	target process
PID 880 wrote to memory of 1304	880	803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3.exe	rundll32.exe
PID 880 wrote to memory of 1304	880	803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3.exe	rundll32.exe
PID 880 wrote to memory of 1304	880	803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3.exe	rundll32.exe
PID 1304 wrote to memory of 1272	1304	rundll32.exe	AcroRd32.exe
PID 1304 wrote to memory of 1272	1304	rundll32.exe	AcroRd32.exe
PID 1304 wrote to memory of 1272	1304	rundll32.exe	AcroRd32.exe
PID 1304 wrote to memory of 1272	1304	rundll32.exe	AcroRd32.exe

C:\Users\Admin\AppData\Local\Temp\803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3.exe
"C:\Users\Admin\AppData\Local\Temp\803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\chlen
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1304

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\chlen"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1272

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\chlen
Filesize
25KB

MD5
6885b91d3e5c45fd2055477d11803f9c

SHA1
3ba4c6210e6354a3d12b9a28ec0d3132d75bb286

SHA256
803a49f017316dba1cbb2f6ee455b14df6f90b519a44f573e64ade6c666133a3

SHA512
ef6989687d71736de385b6d162d92e8ea172fe4b4596e57532652425701bbdc48523e5bb418e39a7873f131d94235b6d505d9cfe32c8c484c6e9b4e1d603ad4a

Download Submit
memory/880-54-0x00000000003B0000-0x00000000003B8000-memory.dmp

Filesize
32KB

Download
memory/880-55-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/880-56-0x000007FEFB6E1000-0x000007FEFB6E3000-memory.dmp

Filesize
8KB

Download
memory/1272-60-0x0000000000000000-mapping.dmp

Download
memory/1272-61-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1304-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing