njrat | ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428

General

Target

ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Size

25KB
MD5

9c8c8f323909f37d2412ac1f1f50d407
SHA1

cc1b07720dfce2d84b68550c878e8ab3ec060607
SHA256

ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428
SHA512

a77d65279950bae9de7e9fce6de314dfd0982c6c2b52535f769bf6792ba800ce6195cad61b064d79398ead271424d4021de691a9e3f8c19058bf8c24db5c6c5b

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

46.158.156.37:27018

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

Processes:

ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe\" .."	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe\" .."	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

pid process

780 ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

pid	process
780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

description	pid	process
Token: SeDebugPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: 33	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
Token: SeIncBasePriorityPrivilege	780	ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

C:\Users\Admin\AppData\Local\Temp\ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
"C:\Users\Admin\AppData\Local\Temp\ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-54-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/780-55-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads