njrat | 3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd

General

Target

3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exe
Size

69KB
MD5

04ee19dcd3079ca37c8f829d2b30513f
SHA1

185f80cc3e7aa3ca8148bc83f240d3789d7e0706
SHA256

3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd
SHA512

1d9ed9e96d4c0ef1aae4aa6c5e5bbbb6ac11f8c8eb9369134aea962caa652469c2a35ba2a961411071bb9dfba8485fee1827f9633217d2947744261ed08a9da5

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

V3Lite.exe

pid process

624 V3Lite.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
624	V3Lite.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exe

Drops startup file 2 IoCs

Processes:

V3Lite.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\257e54d5487aae3e024df308f1deeed9.exe	V3Lite.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\257e54d5487aae3e024df308f1deeed9.exe	V3Lite.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

V3Lite.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\257e54d5487aae3e024df308f1deeed9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\V3Lite.exe\" .."	V3Lite.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\257e54d5487aae3e024df308f1deeed9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\V3Lite.exe\" .."	V3Lite.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exeV3Lite.exe

description	pid	process
Token: SeDebugPrivilege	4880	3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exe
Token: SeDebugPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe
Token: 33	624	V3Lite.exe
Token: SeIncBasePriorityPrivilege	624	V3Lite.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exeV3Lite.exe

description	pid	process	target process
PID 4880 wrote to memory of 624	4880	3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exe	V3Lite.exe
PID 4880 wrote to memory of 624	4880	3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exe	V3Lite.exe
PID 624 wrote to memory of 4516	624	V3Lite.exe	netsh.exe
PID 624 wrote to memory of 4516	624	V3Lite.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exe
"C:\Users\Admin\AppData\Local\Temp\3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880

C:\Users\Admin\AppData\Local\Temp\V3Lite.exe
"C:\Users\Admin\AppData\Local\Temp\V3Lite.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\V3Lite.exe" "V3Lite.exe" ENABLE
3⤵
PID:4516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\V3Lite.exe
Filesize
69KB

MD5
04ee19dcd3079ca37c8f829d2b30513f

SHA1
185f80cc3e7aa3ca8148bc83f240d3789d7e0706

SHA256
3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd

SHA512
1d9ed9e96d4c0ef1aae4aa6c5e5bbbb6ac11f8c8eb9369134aea962caa652469c2a35ba2a961411071bb9dfba8485fee1827f9633217d2947744261ed08a9da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\V3Lite.exe
Filesize
69KB

MD5
04ee19dcd3079ca37c8f829d2b30513f

SHA1
185f80cc3e7aa3ca8148bc83f240d3789d7e0706

SHA256
3780704d28e73654b31a312c7887a202f3b28a15046d0a314f1ba0373e5362dd

SHA512
1d9ed9e96d4c0ef1aae4aa6c5e5bbbb6ac11f8c8eb9369134aea962caa652469c2a35ba2a961411071bb9dfba8485fee1827f9633217d2947744261ed08a9da5

Download Submit
memory/624-132-0x0000000000000000-mapping.dmp

Download
memory/624-135-0x00007FFB5C990000-0x00007FFB5D451000-memory.dmp

Filesize
10.8MB

Download
memory/4516-136-0x0000000000000000-mapping.dmp

Download
memory/4880-130-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

Filesize
64KB

Download
memory/4880-131-0x00007FFB5C990000-0x00007FFB5D451000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads