njrat | 850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87

General

Target

850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe
Size

37KB
MD5

bb9d4ebcc754a7e6cb7536b735d85fdf
SHA1

62a93b979c2634af2b39520df73249747bbed84c
SHA256

850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87
SHA512

e727a8e987da902339c6ceef93e163fedaa8a0a03c5e0784ac919653f0428f8723ebab7d232cef80bd1337956254c4333fba500ee85fdfdc2a80884822e48363

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

miop.ddns.net:2280

Mutex

18df5afc301de09badbb5fa494c2daf3

Attributes

reg_key
18df5afc301de09badbb5fa494c2daf3
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server5.exe

pid process

736 server5.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
736	server5.exe

Drops startup file 2 IoCs

Processes:

server5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18df5afc301de09badbb5fa494c2daf3.exe	server5.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18df5afc301de09badbb5fa494c2daf3.exe	server5.exe

Loads dropped DLL 1 IoCs

Processes:

850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe

pid process

380 850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
380	850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

server5.exe

description	pid	process
Token: SeDebugPrivilege	736	server5.exe
Token: 33	736	server5.exe
Token: SeIncBasePriorityPrivilege	736	server5.exe
Token: 33	736	server5.exe
Token: SeIncBasePriorityPrivilege	736	server5.exe
Token: 33	736	server5.exe
Token: SeIncBasePriorityPrivilege	736	server5.exe
Token: 33	736	server5.exe
Token: SeIncBasePriorityPrivilege	736	server5.exe
Token: 33	736	server5.exe
Token: SeIncBasePriorityPrivilege	736	server5.exe
Token: 33	736	server5.exe
Token: SeIncBasePriorityPrivilege	736	server5.exe
Token: 33	736	server5.exe
Token: SeIncBasePriorityPrivilege	736	server5.exe
Token: 33	736	server5.exe
Token: SeIncBasePriorityPrivilege	736	server5.exe
Token: 33	736	server5.exe
Token: SeIncBasePriorityPrivilege	736	server5.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exeserver5.exe

description	pid	process	target process
PID 380 wrote to memory of 736	380	850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe	server5.exe
PID 380 wrote to memory of 736	380	850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe	server5.exe
PID 380 wrote to memory of 736	380	850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe	server5.exe
PID 380 wrote to memory of 736	380	850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe	server5.exe
PID 736 wrote to memory of 1320	736	server5.exe	netsh.exe
PID 736 wrote to memory of 1320	736	server5.exe	netsh.exe
PID 736 wrote to memory of 1320	736	server5.exe	netsh.exe
PID 736 wrote to memory of 1320	736	server5.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe
"C:\Users\Admin\AppData\Local\Temp\850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:380

C:\Users\Admin\AppData\Local\Temp\server5.exe
"C:\Users\Admin\AppData\Local\Temp\server5.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server5.exe" "server5.exe" ENABLE
3⤵
PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server5.exe
Filesize
37KB

MD5
bb9d4ebcc754a7e6cb7536b735d85fdf

SHA1
62a93b979c2634af2b39520df73249747bbed84c

SHA256
850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87

SHA512
e727a8e987da902339c6ceef93e163fedaa8a0a03c5e0784ac919653f0428f8723ebab7d232cef80bd1337956254c4333fba500ee85fdfdc2a80884822e48363

Download Submit
C:\Users\Admin\AppData\Local\Temp\server5.exe
Filesize
37KB

MD5
bb9d4ebcc754a7e6cb7536b735d85fdf

SHA1
62a93b979c2634af2b39520df73249747bbed84c

SHA256
850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87

SHA512
e727a8e987da902339c6ceef93e163fedaa8a0a03c5e0784ac919653f0428f8723ebab7d232cef80bd1337956254c4333fba500ee85fdfdc2a80884822e48363

Download Submit
\Users\Admin\AppData\Local\Temp\server5.exe
Filesize
37KB

MD5
bb9d4ebcc754a7e6cb7536b735d85fdf

SHA1
62a93b979c2634af2b39520df73249747bbed84c

SHA256
850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87

SHA512
e727a8e987da902339c6ceef93e163fedaa8a0a03c5e0784ac919653f0428f8723ebab7d232cef80bd1337956254c4333fba500ee85fdfdc2a80884822e48363

Download Submit
memory/380-54-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/380-55-0x0000000074FE0000-0x000000007558B000-memory.dmp

Filesize
5.7MB

Download
memory/736-57-0x0000000000000000-mapping.dmp

Download
memory/736-61-0x0000000074FE0000-0x000000007558B000-memory.dmp

Filesize
5.7MB

Download
memory/1320-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads