njrat | 010f5f978596f99377d06c9a6e7b982def7c5cbb857e091af1a3f68c27295bc9

General

Target

NEW_PURCHASE_ORDER_.exe
Size

282KB
MD5

94cd3aef83f29bb2dd6d8fe40d751603
SHA1

eb3439a00509d5e8ba99f97323cf2617d97b3106
SHA256

0fa2721f9583ee945d3909290c0ead73dcf4e3cb5739a6f4423f3da6899fd602
SHA512

fc78829979bd284924cc752dafd47a9dd6813e59b76c9620bd18eb3fb179db66aa87584600d38e15d0637ba52f8fbd8618b2de836251ae9d0e5b0d5c61b9c0db

Score

10^/10

njrat mon$y trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Mon$y

C2

whmfix009.cf:5409

Mutex

67c692a08f8c138aa1c442e78c2761bc

Attributes

reg_key
67c692a08f8c138aa1c442e78c2761bc
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

invoice.exe

pid process

324 invoice.exe
Loads dropped DLL 1 IoCs

Processes:

NEW_PURCHASE_ORDER_.exe

pid process

1944 NEW_PURCHASE_ORDER_.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

NEW_PURCHASE_ORDER_.exe

description pid process target process

PID 384 set thread context of 1944 384 NEW_PURCHASE_ORDER_.exe NEW_PURCHASE_ORDER_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2036 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

NEW_PURCHASE_ORDER_.exeinvoice.exe

pid process

384 NEW_PURCHASE_ORDER_.exe
384 NEW_PURCHASE_ORDER_.exe
384 NEW_PURCHASE_ORDER_.exe
324 invoice.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

NEW_PURCHASE_ORDER_.exeinvoice.exe

description pid process

Token: SeDebugPrivilege 384 NEW_PURCHASE_ORDER_.exe
Token: SeDebugPrivilege 324 invoice.exe

pid	process
324	invoice.exe

pid	process
1944	NEW_PURCHASE_ORDER_.exe

description	pid	process	target process
PID 384 set thread context of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe

pid	process
2036	schtasks.exe

pid	process
384	NEW_PURCHASE_ORDER_.exe
384	NEW_PURCHASE_ORDER_.exe
384	NEW_PURCHASE_ORDER_.exe
324	invoice.exe

description	pid	process
Token: SeDebugPrivilege	384	NEW_PURCHASE_ORDER_.exe
Token: SeDebugPrivilege	324	invoice.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

NEW_PURCHASE_ORDER_.exeNEW_PURCHASE_ORDER_.exe

description	pid	process	target process
PID 384 wrote to memory of 2036	384	NEW_PURCHASE_ORDER_.exe	schtasks.exe
PID 384 wrote to memory of 2036	384	NEW_PURCHASE_ORDER_.exe	schtasks.exe
PID 384 wrote to memory of 2036	384	NEW_PURCHASE_ORDER_.exe	schtasks.exe
PID 384 wrote to memory of 2036	384	NEW_PURCHASE_ORDER_.exe	schtasks.exe
PID 384 wrote to memory of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe
PID 384 wrote to memory of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe
PID 384 wrote to memory of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe
PID 384 wrote to memory of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe
PID 384 wrote to memory of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe
PID 384 wrote to memory of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe
PID 384 wrote to memory of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe
PID 384 wrote to memory of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe
PID 384 wrote to memory of 1944	384	NEW_PURCHASE_ORDER_.exe	NEW_PURCHASE_ORDER_.exe
PID 1944 wrote to memory of 324	1944	NEW_PURCHASE_ORDER_.exe	invoice.exe
PID 1944 wrote to memory of 324	1944	NEW_PURCHASE_ORDER_.exe	invoice.exe
PID 1944 wrote to memory of 324	1944	NEW_PURCHASE_ORDER_.exe	invoice.exe
PID 1944 wrote to memory of 324	1944	NEW_PURCHASE_ORDER_.exe	invoice.exe

C:\Users\Admin\AppData\Local\Temp\NEW_PURCHASE_ORDER_.exe
"C:\Users\Admin\AppData\Local\Temp\NEW_PURCHASE_ORDER_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PVXpBGEUT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE58.tmp"
2⤵
- Creates scheduled task(s)
PID:2036

C:\Users\Admin\AppData\Local\Temp\NEW_PURCHASE_ORDER_.exe
"{path}"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Roaming\invoice.exe
"C:\Users\Admin\AppData\Roaming\invoice.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCE58.tmp
Filesize
1KB

MD5
880a45b53c1a930111e70009307a0b04

SHA1
40bbf403adde9d5d180df37c3e48c3061cc6bb1e

SHA256
0185e42ae3530889ec5a69a3454c3c9657503a3b2d923af719bfc852a817fcaa

SHA512
01ec41e901b31f67af5c4477c854753b7804d55c72ee183eabdd44a623b8e777aa027113e41e20623f7fc2cb11a9035672f90c482e201ae08cf055e5734fd1a5

Download Submit
C:\Users\Admin\AppData\Roaming\invoice.exe
Filesize
282KB

MD5
94cd3aef83f29bb2dd6d8fe40d751603

SHA1
eb3439a00509d5e8ba99f97323cf2617d97b3106

SHA256
0fa2721f9583ee945d3909290c0ead73dcf4e3cb5739a6f4423f3da6899fd602

SHA512
fc78829979bd284924cc752dafd47a9dd6813e59b76c9620bd18eb3fb179db66aa87584600d38e15d0637ba52f8fbd8618b2de836251ae9d0e5b0d5c61b9c0db

Download Submit
C:\Users\Admin\AppData\Roaming\invoice.exe
Filesize
282KB

MD5
94cd3aef83f29bb2dd6d8fe40d751603

SHA1
eb3439a00509d5e8ba99f97323cf2617d97b3106

SHA256
0fa2721f9583ee945d3909290c0ead73dcf4e3cb5739a6f4423f3da6899fd602

SHA512
fc78829979bd284924cc752dafd47a9dd6813e59b76c9620bd18eb3fb179db66aa87584600d38e15d0637ba52f8fbd8618b2de836251ae9d0e5b0d5c61b9c0db

Download Submit
\Users\Admin\AppData\Roaming\invoice.exe
Filesize
282KB

MD5
94cd3aef83f29bb2dd6d8fe40d751603

SHA1
eb3439a00509d5e8ba99f97323cf2617d97b3106

SHA256
0fa2721f9583ee945d3909290c0ead73dcf4e3cb5739a6f4423f3da6899fd602

SHA512
fc78829979bd284924cc752dafd47a9dd6813e59b76c9620bd18eb3fb179db66aa87584600d38e15d0637ba52f8fbd8618b2de836251ae9d0e5b0d5c61b9c0db

Download Submit
memory/324-79-0x0000000000830000-0x0000000000864000-memory.dmp

Filesize
208KB

Download
memory/324-77-0x0000000000F10000-0x0000000000F5C000-memory.dmp

Filesize
304KB

Download
memory/324-74-0x0000000000000000-mapping.dmp

Download
memory/384-55-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/384-56-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/384-57-0x0000000000660000-0x0000000000694000-memory.dmp

Filesize
208KB

Download
memory/384-58-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/384-54-0x0000000000340000-0x000000000038C000-memory.dmp

Filesize
304KB

Download
memory/1944-65-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-69-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-71-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-67-0x000000000040747E-mapping.dmp

Download
memory/1944-66-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-64-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1944-61-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2036-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads