njrat | 1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0

General

Target

1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe
Size

37KB
MD5

8a3c07e101a69711eee5c4f21c4a5199
SHA1

86c4438cb25b6bc2e7f4b3865f809bddcd7ea096
SHA256

1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0
SHA512

8b582230e9a67397fd3f36fd1b9c91331852332b27807696faf809163b6474384a6aa6c3599c96d7b6d25ee917fea962f6af8a334045103c4687f9302b8ed62e

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

192.168.0.12:5552

Mutex

536ec81ea4d08ca810ee637d596cf35e

Attributes

reg_key
536ec81ea4d08ca810ee637d596cf35e
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Discordinstaler.exe

pid process

1424 Discordinstaler.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Loads dropped DLL 1 IoCs

Processes:

1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe

pid process

1972 1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1424	Discordinstaler.exe

pid	process
1972	1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

Discordinstaler.exe

description	pid	process
Token: SeDebugPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe
Token: 33	1424	Discordinstaler.exe
Token: SeIncBasePriorityPrivilege	1424	Discordinstaler.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exeDiscordinstaler.exe

description	pid	process	target process
PID 1972 wrote to memory of 1424	1972	1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe	Discordinstaler.exe
PID 1972 wrote to memory of 1424	1972	1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe	Discordinstaler.exe
PID 1972 wrote to memory of 1424	1972	1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe	Discordinstaler.exe
PID 1972 wrote to memory of 1424	1972	1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe	Discordinstaler.exe
PID 1972 wrote to memory of 1424	1972	1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe	Discordinstaler.exe
PID 1972 wrote to memory of 1424	1972	1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe	Discordinstaler.exe
PID 1972 wrote to memory of 1424	1972	1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe	Discordinstaler.exe
PID 1424 wrote to memory of 1136	1424	Discordinstaler.exe	netsh.exe
PID 1424 wrote to memory of 1136	1424	Discordinstaler.exe	netsh.exe
PID 1424 wrote to memory of 1136	1424	Discordinstaler.exe	netsh.exe
PID 1424 wrote to memory of 1136	1424	Discordinstaler.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe
"C:\Users\Admin\AppData\Local\Temp\1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\Discordinstaler.exe
"C:\Users\Admin\AppData\Local\Temp\Discordinstaler.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Discordinstaler.exe" "Discordinstaler.exe" ENABLE
3⤵
PID:1136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Discordinstaler.exe
Filesize
37KB

MD5
8a3c07e101a69711eee5c4f21c4a5199

SHA1
86c4438cb25b6bc2e7f4b3865f809bddcd7ea096

SHA256
1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0

SHA512
8b582230e9a67397fd3f36fd1b9c91331852332b27807696faf809163b6474384a6aa6c3599c96d7b6d25ee917fea962f6af8a334045103c4687f9302b8ed62e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Discordinstaler.exe
Filesize
37KB

MD5
8a3c07e101a69711eee5c4f21c4a5199

SHA1
86c4438cb25b6bc2e7f4b3865f809bddcd7ea096

SHA256
1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0

SHA512
8b582230e9a67397fd3f36fd1b9c91331852332b27807696faf809163b6474384a6aa6c3599c96d7b6d25ee917fea962f6af8a334045103c4687f9302b8ed62e

Download Submit
\Users\Admin\AppData\Local\Temp\Discordinstaler.exe
Filesize
37KB

MD5
8a3c07e101a69711eee5c4f21c4a5199

SHA1
86c4438cb25b6bc2e7f4b3865f809bddcd7ea096

SHA256
1c01402caca44bb88644241d8759f29b5ab70bce7640429485c1ab42d35f54b0

SHA512
8b582230e9a67397fd3f36fd1b9c91331852332b27807696faf809163b6474384a6aa6c3599c96d7b6d25ee917fea962f6af8a334045103c4687f9302b8ed62e

Download Submit
memory/1136-62-0x0000000000000000-mapping.dmp

Download
memory/1424-57-0x0000000000000000-mapping.dmp

Download
memory/1424-61-0x0000000073F50000-0x00000000744FB000-memory.dmp

Filesize
5.7MB

Download
memory/1972-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x0000000073F50000-0x00000000744FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing