njrat | c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba

General

Target

c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Size

31KB
MD5

93acffd0b33c2b03eda54bfc141a6cf3
SHA1

c52480c12edf299374e90ece7fa9b65a714c2078
SHA256

c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba
SHA512

1d458115045c41531ff76f1497fe62bc14b62ea9f9025386ae83d927474874456f20895824e3d888f63b3e615d7312f7b661d9cb0b024e59daf4bc984a70e457

Score

10^/10

njrat evasion trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe

description	pid	process
Token: SeDebugPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: 33	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
Token: SeIncBasePriorityPrivilege	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe

description	pid	process	target process
PID 4116 wrote to memory of 4372	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe	netsh.exe
PID 4116 wrote to memory of 4372	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe	netsh.exe
PID 4116 wrote to memory of 4372	4116	c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe
"C:\Users\Admin\AppData\Local\Temp\c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe" "c25e2efcf612808a8f4a79474cac60b2f51eea52121acdd5990c45052f743dba.exe" ENABLE
2⤵
PID:4372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4116-130-0x00000000752D0000-0x0000000075881000-memory.dmp

Filesize
5.7MB

Download
memory/4372-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing