njrat | 9d2cbc7c4473f5214a329809a4c6f088316c283f227e9598233b49e11e8a3892

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20220414-en
submitted
20/05/2022, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe
Size 406KB
Sample220520-vhdb5aafb9
SHA256 9d2cbc7c4473f5214a329809a4c6f088316c283f227e9598233b49e11e8a3892
MD5 53e88f1ad51339c5f3e501f688f094db
SHA1 636ecde3a0ad58dd4e2c96b2f34868b46b7c0f48
SHA512 9831d6a917240d5567204de37837489a1d78420290b81c962a86032d5ceea8785e884a52aaf737cd1c8cf75507219c6b3a417fb111a4acc826f2571a91212a5e
MD5 SHA1 SHA512

Score

10^/10

njrat persistence suricata trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata

Executes dropped EXE 2 IoCs

pid	Process
472	Updates.exe
1168	Updates.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Temp.exe	Updates.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Temp.exe	Updates.exe

Loads dropped DLL 1 IoCs

pid	Process
472	Updates.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Updates.exe -boot"	Updates.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 472 set thread context of 1168	472	Updates.exe	31

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	Updates.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	Updates.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe
Token: SeDebugPrivilege	472	Updates.exe
Token: SeDebugPrivilege	1168	Updates.exe
Token: 33	1168	Updates.exe
Token: SeIncBasePriorityPrivilege	1168	Updates.exe
Token: 33	1168	Updates.exe
Token: SeIncBasePriorityPrivilege	1168	Updates.exe
Token: 33	1168	Updates.exe
Token: SeIncBasePriorityPrivilege	1168	Updates.exe
Token: 33	1168	Updates.exe
Token: SeIncBasePriorityPrivilege	1168	Updates.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1732	1612	9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe	28
PID 1612 wrote to memory of 1732	1612	9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe	28
PID 1612 wrote to memory of 1732	1612	9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe	28
PID 1612 wrote to memory of 1732	1612	9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe	28
PID 1588 wrote to memory of 472	1588	explorer.exe	30
PID 1588 wrote to memory of 472	1588	explorer.exe	30
PID 1588 wrote to memory of 472	1588	explorer.exe	30
PID 1588 wrote to memory of 472	1588	explorer.exe	30
PID 1588 wrote to memory of 472	1588	explorer.exe	30
PID 1588 wrote to memory of 472	1588	explorer.exe	30
PID 1588 wrote to memory of 472	1588	explorer.exe	30
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31
PID 472 wrote to memory of 1168	472	Updates.exe	31

C:\Users\Admin\AppData\Local\Temp\9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe
"C:\Users\Admin\AppData\Local\Temp\9D2CBC7C4473F5214A329809A4C6F088316C283F227E9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Updates.exe
  2⤵
  PID:1732

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Updates.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Updates.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Updates.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Updates.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of AdjustPrivilegeToken
    PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Updates.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Updates.exe
Size 406KB
SHA256 9d2cbc7c4473f5214a329809a4c6f088316c283f227e9598233b49e11e8a3892
MD5 53e88f1ad51339c5f3e501f688f094db
SHA1 636ecde3a0ad58dd4e2c96b2f34868b46b7c0f48
SHA512 9831d6a917240d5567204de37837489a1d78420290b81c962a86032d5ceea8785e884a52aaf737cd1c8cf75507219c6b3a417fb111a4acc826f2571a91212a5e
SSDEEP 3072:tLmG8ZqqDcaK7Ony7GVqiMXKvp6yGwWzF8VFNizstsUF1GZlsCA6/kYuies+KxK9:4G84vaz9KCPOqjig3F1dkxT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Updates.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Updates.exe
Size 406KB
SHA256 9d2cbc7c4473f5214a329809a4c6f088316c283f227e9598233b49e11e8a3892
MD5 53e88f1ad51339c5f3e501f688f094db
SHA1 636ecde3a0ad58dd4e2c96b2f34868b46b7c0f48
SHA512 9831d6a917240d5567204de37837489a1d78420290b81c962a86032d5ceea8785e884a52aaf737cd1c8cf75507219c6b3a417fb111a4acc826f2571a91212a5e
SSDEEP 3072:tLmG8ZqqDcaK7Ony7GVqiMXKvp6yGwWzF8VFNizstsUF1GZlsCA6/kYuies+KxK9:4G84vaz9KCPOqjig3F1dkxT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Updates.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Updates.exe
Size 406KB
SHA256 9d2cbc7c4473f5214a329809a4c6f088316c283f227e9598233b49e11e8a3892
MD5 53e88f1ad51339c5f3e501f688f094db
SHA1 636ecde3a0ad58dd4e2c96b2f34868b46b7c0f48
SHA512 9831d6a917240d5567204de37837489a1d78420290b81c962a86032d5ceea8785e884a52aaf737cd1c8cf75507219c6b3a417fb111a4acc826f2571a91212a5e
SSDEEP 3072:tLmG8ZqqDcaK7Ony7GVqiMXKvp6yGwWzF8VFNizstsUF1GZlsCA6/kYuies+KxK9:4G84vaz9KCPOqjig3F1dkxT
MD5 SHA1 SHA512 SSDEEP

Submit Download

enterprisesec.config.cch

Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch
Size 476B
SHA256 202b630bcb9d7c0624ff6f828813fdc1c756e969019b57e3d7358024f5345b5c
MD5 eccdcfd7d29f18edf42a5f01eba93352
SHA1 27475f97e539ee0662957edfeb41458c18d0f72c
SHA512 cc5901f9f36787a6d3d86bd1ba468c11997e16ea9f1f0e42613857e39ffb166284b3f8659275facc41c896c22b5429205bc2a91408853b30e11b52ba23ddfae3
MD5 SHA1 SHA512

Submit Download

security.config.cch

Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
Size 476B
SHA256 202b630bcb9d7c0624ff6f828813fdc1c756e969019b57e3d7358024f5345b5c
MD5 eccdcfd7d29f18edf42a5f01eba93352
SHA1 27475f97e539ee0662957edfeb41458c18d0f72c
SHA512 cc5901f9f36787a6d3d86bd1ba468c11997e16ea9f1f0e42613857e39ffb166284b3f8659275facc41c896c22b5429205bc2a91408853b30e11b52ba23ddfae3
MD5 SHA1 SHA512

Submit Download

Updates.exe

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Updates.exe
Size 406KB
SHA256 9d2cbc7c4473f5214a329809a4c6f088316c283f227e9598233b49e11e8a3892
MD5 53e88f1ad51339c5f3e501f688f094db
SHA1 636ecde3a0ad58dd4e2c96b2f34868b46b7c0f48
SHA512 9831d6a917240d5567204de37837489a1d78420290b81c962a86032d5ceea8785e884a52aaf737cd1c8cf75507219c6b3a417fb111a4acc826f2571a91212a5e
SSDEEP 3072:tLmG8ZqqDcaK7Ony7GVqiMXKvp6yGwWzF8VFNizstsUF1GZlsCA6/kYuies+KxK9:4G84vaz9KCPOqjig3F1dkxT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/472-65-0x0000000074AE0000-0x000000007508B000-memory.dmp

Download

memory/1168-70-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/1168-67-0x0000000000402000-0x0000000000415000-memory.dmp

Download

memory/1168-69-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/1168-72-0x0000000000402000-0x0000000000415000-memory.dmp

Download

memory/1168-75-0x0000000074AE0000-0x000000007508B000-memory.dmp

Download

memory/1588-59-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

Download

memory/1612-54-0x0000000076531000-0x0000000076533000-memory.dmp

Download

memory/1612-55-0x0000000074AE0000-0x000000007508B000-memory.dmp

Download

memory/1732-58-0x0000000071BA1000-0x0000000071BA3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads