njrat | 78769e4085312f21cc67e77bfdd136f9a30d34e2d2a5d8870f2ebbeb7c3a8f7e

Analysis

Target

malware-analysis-writeups-master/bashar-bachir-chain/files/nod.ps1
Size

420KB
MD5

48edd7d80fd0b0846304f21436886345
SHA1

b3ef389d9b405aa2a05921053dae69472294b600
SHA256

f398f78aa8c9d3e515ecb829bd677c69abe4aac8352462bbadacff2b42d20117
SHA512

06a8159b34b6bd45d08517bcc0a0ad15405c3116af587040419ec52624f1f8c9edf8e5380e76c4160e80ea81fadc9413ce0f3ba97bb2a6bfe95a7557c98ea28e

Score

10^/10

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1940 set thread context of 4308 1940 powershell.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1940 powershell.exe
1940 powershell.exe

description	pid	process	target process
PID 1940 set thread context of 4308	1940	powershell.exe	RegAsm.exe

pid	process
1940	powershell.exe
1940	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

powershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	4308	RegAsm.exe
Token: 33	4308	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4308	RegAsm.exe
Token: 33	4308	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4308	RegAsm.exe
Token: 33	4308	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4308	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

powershell.exeRegAsm.exe

description	pid	process	target process
PID 1940 wrote to memory of 4308	1940	powershell.exe	RegAsm.exe
PID 1940 wrote to memory of 4308	1940	powershell.exe	RegAsm.exe
PID 1940 wrote to memory of 4308	1940	powershell.exe	RegAsm.exe
PID 1940 wrote to memory of 4308	1940	powershell.exe	RegAsm.exe
PID 1940 wrote to memory of 4308	1940	powershell.exe	RegAsm.exe
PID 1940 wrote to memory of 4308	1940	powershell.exe	RegAsm.exe
PID 1940 wrote to memory of 4308	1940	powershell.exe	RegAsm.exe
PID 1940 wrote to memory of 4308	1940	powershell.exe	RegAsm.exe
PID 4308 wrote to memory of 4240	4308	RegAsm.exe	netsh.exe
PID 4308 wrote to memory of 4240	4308	RegAsm.exe	netsh.exe
PID 4308 wrote to memory of 4240	4308	RegAsm.exe	netsh.exe

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
3⤵
PID:4240

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1940-130-0x00000265D7CB0000-0x00000265D7CD2000-memory.dmp

Filesize
136KB

Download
memory/1940-131-0x00007FFEACCE0000-0x00007FFEAD7A1000-memory.dmp

Filesize
10.8MB

Download
memory/4240-135-0x0000000000000000-mapping.dmp

Download
memory/4308-133-0x00000000004078C6-mapping.dmp

Download
memory/4308-132-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4308-134-0x0000000074990000-0x0000000074F41000-memory.dmp

Filesize
5.7MB

Download