njrat | dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e

General

Target

dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe
Size

275KB
MD5

6ec21f506d9b403b147d9fe40ca7ebd3
SHA1

455db25e659fa157b0ce4cdcdc32c865b2f6b1e2
SHA256

dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e
SHA512

72d34c4b2517a6d709bb2c710bf54f9974b692c86fcf178749b2357dcc3b257bad86e3f1cec8ea1fed8871adac56ac48d8cecba3bfcef49a094fd40e29e10992

Score

10^/10

njrat lime trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Lime

C2

kornporp.duckdns.org:6699

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
luffy

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe

description	pid	process	target process
PID 3004 set thread context of 4504	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Powershell.exe

pid process

2336 Powershell.exe
2336 Powershell.exe

pid	process
2336	Powershell.exe
2336	Powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exePowershell.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe
Token: SeDebugPrivilege	2336	Powershell.exe
Token: SeDebugPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe
Token: 33	4504	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	4504	InstallUtil.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe

description	pid	process	target process
PID 3004 wrote to memory of 4504	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	InstallUtil.exe
PID 3004 wrote to memory of 4504	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	InstallUtil.exe
PID 3004 wrote to memory of 4504	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	InstallUtil.exe
PID 3004 wrote to memory of 4504	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	InstallUtil.exe
PID 3004 wrote to memory of 4504	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	InstallUtil.exe
PID 3004 wrote to memory of 4504	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	InstallUtil.exe
PID 3004 wrote to memory of 4504	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	InstallUtil.exe
PID 3004 wrote to memory of 4504	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	InstallUtil.exe
PID 3004 wrote to memory of 2336	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	Powershell.exe
PID 3004 wrote to memory of 2336	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	Powershell.exe
PID 3004 wrote to memory of 2336	3004	dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe	Powershell.exe

C:\Users\Admin\AppData\Local\Temp\dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe
"C:\Users\Admin\AppData\Local\Temp\dc8bfeafe82d1216850834deb12cf331e7920dff641d652d3a0652c9d32cf09e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mapeosql\Mapeosql.exe"'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-148-0x0000000006950000-0x000000000696E000-memory.dmp

Filesize
120KB

Download
memory/2336-150-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/2336-154-0x0000000006880000-0x000000000689A000-memory.dmp

Filesize
104KB

Download
memory/2336-153-0x00000000050C0000-0x00000000050CE000-memory.dmp

Filesize
56KB

Download
memory/2336-147-0x00000000709A0000-0x00000000709EC000-memory.dmp

Filesize
304KB

Download
memory/2336-151-0x0000000007720000-0x000000000772A000-memory.dmp

Filesize
40KB

Download
memory/2336-155-0x0000000006870000-0x0000000006878000-memory.dmp

Filesize
32KB

Download
memory/2336-149-0x0000000007D00000-0x000000000837A000-memory.dmp

Filesize
6.5MB

Download
memory/2336-152-0x0000000007930000-0x00000000079C6000-memory.dmp

Filesize
600KB

Download
memory/2336-139-0x0000000000000000-mapping.dmp

Download
memory/2336-141-0x0000000002A30000-0x0000000002A66000-memory.dmp

Filesize
216KB

Download
memory/2336-142-0x00000000056E0000-0x0000000005D08000-memory.dmp

Filesize
6.2MB

Download
memory/2336-146-0x0000000006970000-0x00000000069A2000-memory.dmp

Filesize
200KB

Download
memory/2336-144-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/2336-143-0x0000000005470000-0x0000000005492000-memory.dmp

Filesize
136KB

Download
memory/2336-145-0x00000000063C0000-0x00000000063DE000-memory.dmp

Filesize
120KB

Download
memory/3004-136-0x0000000007490000-0x00000000074F6000-memory.dmp

Filesize
408KB

Download
memory/3004-130-0x0000000000170000-0x00000000001BA000-memory.dmp

Filesize
296KB

Download
memory/3004-135-0x00000000072A0000-0x00000000072BE000-memory.dmp

Filesize
120KB

Download
memory/3004-134-0x00000000072E0000-0x0000000007356000-memory.dmp

Filesize
472KB

Download
memory/3004-133-0x0000000004D20000-0x0000000004D2A000-memory.dmp

Filesize
40KB

Download
memory/3004-132-0x0000000004B90000-0x0000000004C22000-memory.dmp

Filesize
584KB

Download
memory/3004-131-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download
memory/4504-137-0x0000000000000000-mapping.dmp

Download
memory/4504-140-0x00000000057D0000-0x000000000586C000-memory.dmp

Filesize
624KB

Download
memory/4504-138-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads