njrat | 3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed

Analysis

max time kernel
156s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe
Size

1.1MB
MD5

bed8273f6aa0838212bfd15422318320
SHA1

ba3abe75066d40dd95ebe7b6a601fe005b4d2dfd
SHA256

3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed
SHA512

6aa2021b5c559c856e53925f710646db430ca35f1bbe81f334e8275a3f9e9dded58bfb3c5839f9c7d453a2a8e69cdee67b43d3e4c9727c0a813f7ac2b14d2039

Score

10^/10

njrat hacked miner persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

31.10.120.162:5555

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner
Executes dropped EXE 4 IoCs

Processes:

system.exenikoVIRA alph 13.10.4.2.exeServer.exeServer.exe

pid process

4436 system.exe
1560 nikoVIRA alph 13.10.4.2.exe
1336 Server.exe
1044 Server.exe

pid	process
4436	system.exe
1560	nikoVIRA alph 13.10.4.2.exe
1336	Server.exe
1044	Server.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exenikoVIRA alph 13.10.4.2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	nikoVIRA alph 13.10.4.2.exe

Drops startup file 2 IoCs

Processes:

Server.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Server.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exeServer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOFIHOJEDKNAPGB = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe"	3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4308 schtasks.exe

pid	process
4308	schtasks.exe

Modifies registry class 2 IoCs

Processes:

3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exenikoVIRA alph 13.10.4.2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	nikoVIRA alph 13.10.4.2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Server.exe

pid process

1336 Server.exe

pid	process
1336	Server.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	1336	Server.exe
Token: 33	1336	Server.exe
Token: SeIncBasePriorityPrivilege	1336	Server.exe
Token: 33	1336	Server.exe
Token: SeIncBasePriorityPrivilege	1336	Server.exe
Token: 33	1336	Server.exe
Token: SeIncBasePriorityPrivilege	1336	Server.exe
Token: 33	1336	Server.exe
Token: SeIncBasePriorityPrivilege	1336	Server.exe
Token: 33	1336	Server.exe
Token: SeIncBasePriorityPrivilege	1336	Server.exe
Token: 33	1336	Server.exe
Token: SeIncBasePriorityPrivilege	1336	Server.exe
Token: 33	1336	Server.exe
Token: SeIncBasePriorityPrivilege	1336	Server.exe
Token: 33	1336	Server.exe
Token: SeIncBasePriorityPrivilege	1336	Server.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exenikoVIRA alph 13.10.4.2.exeServer.exe

description	pid	process	target process
PID 3176 wrote to memory of 4436	3176	3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe	system.exe
PID 3176 wrote to memory of 4436	3176	3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe	system.exe
PID 3176 wrote to memory of 1560	3176	3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe	nikoVIRA alph 13.10.4.2.exe
PID 3176 wrote to memory of 1560	3176	3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe	nikoVIRA alph 13.10.4.2.exe
PID 3176 wrote to memory of 1560	3176	3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe	nikoVIRA alph 13.10.4.2.exe
PID 1560 wrote to memory of 4244	1560	nikoVIRA alph 13.10.4.2.exe	NOTEPAD.EXE
PID 1560 wrote to memory of 4244	1560	nikoVIRA alph 13.10.4.2.exe	NOTEPAD.EXE
PID 1560 wrote to memory of 4244	1560	nikoVIRA alph 13.10.4.2.exe	NOTEPAD.EXE
PID 1560 wrote to memory of 1336	1560	nikoVIRA alph 13.10.4.2.exe	Server.exe
PID 1560 wrote to memory of 1336	1560	nikoVIRA alph 13.10.4.2.exe	Server.exe
PID 1560 wrote to memory of 1336	1560	nikoVIRA alph 13.10.4.2.exe	Server.exe
PID 1336 wrote to memory of 4308	1336	Server.exe	schtasks.exe
PID 1336 wrote to memory of 4308	1336	Server.exe	schtasks.exe
PID 1336 wrote to memory of 4308	1336	Server.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe
"C:\Users\Admin\AppData\Local\Temp\3bb145b5108de842674b84ed2a006e8cbff59323b70a928da2ded92288bf05ed.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3176

C:\Users\Admin\AppData\Local\Temp\system.exe
"C:\Users\Admin\AppData\Local\Temp\system.exe" -a cryptonight -o stratum+tcp://btc.pool.minergate.com:45560 -u egacom2288@gmail.com -t 1
2⤵
- Executes dropped EXE
PID:4436

C:\Users\Admin\AppData\Local\Temp\nikoVIRA alph 13.10.4.2.exe
"C:\Users\Admin\AppData\Local\Temp\nikoVIRA alph 13.10.4.2.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Новый текстовый документ.txt
3⤵
PID:4244

C:\Users\Admin\AppData\Roaming\Server.exe
"C:\Users\Admin\AppData\Roaming\Server.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
4⤵
- Creates scheduled task(s)
PID:4308

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:1044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
c43aaf0146a014160aaebe2f65150e62

SHA1
7c5bbccf84201c6bd05ed86c4ad88400a3d59575

SHA256
4f927df346172359d5af13322514bb7ede61d35d6785729a563a872ac4a9ff13

SHA512
8a5d258e76f29aa25985280169745dbc28e68d50dd6d8c784dfa5b7196abfc9b63cafa14c034d994b02444a311125e24f7ed302d0338ccc56fd2b5c7e420a64b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
c43aaf0146a014160aaebe2f65150e62

SHA1
7c5bbccf84201c6bd05ed86c4ad88400a3d59575

SHA256
4f927df346172359d5af13322514bb7ede61d35d6785729a563a872ac4a9ff13

SHA512
8a5d258e76f29aa25985280169745dbc28e68d50dd6d8c784dfa5b7196abfc9b63cafa14c034d994b02444a311125e24f7ed302d0338ccc56fd2b5c7e420a64b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nikoVIRA alph 13.10.4.2.exe
Filesize
710KB

MD5
c93248685712aca2903f41280ebf535e

SHA1
1cc106d0822eecd8b9b6d56780fe19d826485768

SHA256
c0014ac7d901c2e1231fa5e7734d5db64070dc08fb71adaf7720090f45d4e471

SHA512
21ae26e97aec9feeae3b3205a159ba7407970c58029093969e6fb3dc5c776f83796d076c2f4e8823ac029beb629e8607f85fdf58170835d6e17b01930b2076fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nikoVIRA alph 13.10.4.2.exe
Filesize
710KB

MD5
c93248685712aca2903f41280ebf535e

SHA1
1cc106d0822eecd8b9b6d56780fe19d826485768

SHA256
c0014ac7d901c2e1231fa5e7734d5db64070dc08fb71adaf7720090f45d4e471

SHA512
21ae26e97aec9feeae3b3205a159ba7407970c58029093969e6fb3dc5c776f83796d076c2f4e8823ac029beb629e8607f85fdf58170835d6e17b01930b2076fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe
Filesize
502KB

MD5
806779989c6ea355a1abf4f6c7cb646c

SHA1
36d7f7a57e2a8ec953940d15099cae2fc565c16e

SHA256
126395638de030e60d4a3a5cf7a8f8b664aac9ca37dc9a766182f8dfd5228fe4

SHA512
87cb14530041b4c09e7de2f77b5a7e2d60278f6916dbed663a1e90e2b35d916f1ff05908ea562661bd5598c60799191ea95550e7e98e8b4ab218179217aecb51

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe
Filesize
502KB

MD5
806779989c6ea355a1abf4f6c7cb646c

SHA1
36d7f7a57e2a8ec953940d15099cae2fc565c16e

SHA256
126395638de030e60d4a3a5cf7a8f8b664aac9ca37dc9a766182f8dfd5228fe4

SHA512
87cb14530041b4c09e7de2f77b5a7e2d60278f6916dbed663a1e90e2b35d916f1ff05908ea562661bd5598c60799191ea95550e7e98e8b4ab218179217aecb51

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
43KB

MD5
c43aaf0146a014160aaebe2f65150e62

SHA1
7c5bbccf84201c6bd05ed86c4ad88400a3d59575

SHA256
4f927df346172359d5af13322514bb7ede61d35d6785729a563a872ac4a9ff13

SHA512
8a5d258e76f29aa25985280169745dbc28e68d50dd6d8c784dfa5b7196abfc9b63cafa14c034d994b02444a311125e24f7ed302d0338ccc56fd2b5c7e420a64b

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
43KB

MD5
c43aaf0146a014160aaebe2f65150e62

SHA1
7c5bbccf84201c6bd05ed86c4ad88400a3d59575

SHA256
4f927df346172359d5af13322514bb7ede61d35d6785729a563a872ac4a9ff13

SHA512
8a5d258e76f29aa25985280169745dbc28e68d50dd6d8c784dfa5b7196abfc9b63cafa14c034d994b02444a311125e24f7ed302d0338ccc56fd2b5c7e420a64b

Download Submit
C:\Users\Admin\AppData\Roaming\Новый текстовый документ.txt
Filesize
55.5MB

MD5
90ad01221aca326184512bd924aa80b3

SHA1
5cadad1a1feed32529dd5c4f3a367588042206aa

SHA256
fe63530654ff0f7e301429003c8400b35428252eb5df6a3cd28db53e98ad8055

SHA512
a0c7a73074885394dbd80d55c711d2d77e34eac94f8bfaea5c3fb8f7837ec8583a6f186be8c8f37558b9bc6d25e97932b745884d4bdbc934d1d8f6a8f6eca08d

Download Submit
memory/1336-145-0x0000000004FF0000-0x0000000005082000-memory.dmp

Filesize
584KB

Download
memory/1336-139-0x0000000000000000-mapping.dmp

Download
memory/1336-142-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download
memory/1336-143-0x0000000004C60000-0x0000000004CFC000-memory.dmp

Filesize
624KB

Download
memory/1336-144-0x00000000054C0000-0x0000000005A64000-memory.dmp

Filesize
5.6MB

Download
memory/1336-148-0x0000000005300000-0x000000000530A000-memory.dmp

Filesize
40KB

Download
memory/1560-133-0x0000000000000000-mapping.dmp

Download
memory/4244-137-0x0000000000000000-mapping.dmp

Download
memory/4308-146-0x0000000000000000-mapping.dmp

Download
memory/4436-130-0x0000000000000000-mapping.dmp

Download
memory/4436-135-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download