Analysis
-
max time kernel
153s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-06-2022 15:10
Behavioral task
behavioral1
Sample
1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe
Resource
win10v2004-20220414-en
General
-
Target
1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe
-
Size
132KB
-
MD5
7a5141d5681b79d64e8b0c7a19785881
-
SHA1
c85ee9fd78fce19b5418bd1a65b5697ccf0d0217
-
SHA256
1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202
-
SHA512
2ae457093a18d3427804f36b21377e5f2fc5529a4e00e74b97ef106fae4783247c7b97b02808b089baeb5bda6252fca4cdf72ef66141f6269ceb97b1cbf6a321
Malware Config
Extracted
njrat
0.7d
Public
ddns81.airdns.org:18681
a319f91b31a91d1c47b040e22bd78fcd
-
reg_key
a319f91b31a91d1c47b040e22bd78fcd
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
NJRAT.exepid process 828 NJRAT.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
NJRAT.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a319f91b31a91d1c47b040e22bd78fcd.exe NJRAT.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a319f91b31a91d1c47b040e22bd78fcd.exe NJRAT.exe -
Loads dropped DLL 1 IoCs
Processes:
1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exepid process 1516 1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
NJRAT.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\a319f91b31a91d1c47b040e22bd78fcd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NJRAT.exe\" .." NJRAT.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\a319f91b31a91d1c47b040e22bd78fcd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NJRAT.exe\" .." NJRAT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
NJRAT.exedescription pid process Token: SeDebugPrivilege 828 NJRAT.exe Token: 33 828 NJRAT.exe Token: SeIncBasePriorityPrivilege 828 NJRAT.exe Token: 33 828 NJRAT.exe Token: SeIncBasePriorityPrivilege 828 NJRAT.exe Token: 33 828 NJRAT.exe Token: SeIncBasePriorityPrivilege 828 NJRAT.exe Token: 33 828 NJRAT.exe Token: SeIncBasePriorityPrivilege 828 NJRAT.exe Token: 33 828 NJRAT.exe Token: SeIncBasePriorityPrivilege 828 NJRAT.exe Token: 33 828 NJRAT.exe Token: SeIncBasePriorityPrivilege 828 NJRAT.exe Token: 33 828 NJRAT.exe Token: SeIncBasePriorityPrivilege 828 NJRAT.exe Token: 33 828 NJRAT.exe Token: SeIncBasePriorityPrivilege 828 NJRAT.exe Token: 33 828 NJRAT.exe Token: SeIncBasePriorityPrivilege 828 NJRAT.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exeNJRAT.exedescription pid process target process PID 1516 wrote to memory of 828 1516 1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe NJRAT.exe PID 1516 wrote to memory of 828 1516 1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe NJRAT.exe PID 1516 wrote to memory of 828 1516 1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe NJRAT.exe PID 1516 wrote to memory of 828 1516 1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe NJRAT.exe PID 828 wrote to memory of 1120 828 NJRAT.exe netsh.exe PID 828 wrote to memory of 1120 828 NJRAT.exe netsh.exe PID 828 wrote to memory of 1120 828 NJRAT.exe netsh.exe PID 828 wrote to memory of 1120 828 NJRAT.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe"C:\Users\Admin\AppData\Local\Temp\1c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NJRAT.exe"C:\Users\Admin\AppData\Local\Temp\NJRAT.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\NJRAT.exe" "NJRAT.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\NJRAT.exeFilesize
132KB
MD57a5141d5681b79d64e8b0c7a19785881
SHA1c85ee9fd78fce19b5418bd1a65b5697ccf0d0217
SHA2561c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202
SHA5122ae457093a18d3427804f36b21377e5f2fc5529a4e00e74b97ef106fae4783247c7b97b02808b089baeb5bda6252fca4cdf72ef66141f6269ceb97b1cbf6a321
-
C:\Users\Admin\AppData\Local\Temp\NJRAT.exeFilesize
132KB
MD57a5141d5681b79d64e8b0c7a19785881
SHA1c85ee9fd78fce19b5418bd1a65b5697ccf0d0217
SHA2561c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202
SHA5122ae457093a18d3427804f36b21377e5f2fc5529a4e00e74b97ef106fae4783247c7b97b02808b089baeb5bda6252fca4cdf72ef66141f6269ceb97b1cbf6a321
-
\Users\Admin\AppData\Local\Temp\NJRAT.exeFilesize
132KB
MD57a5141d5681b79d64e8b0c7a19785881
SHA1c85ee9fd78fce19b5418bd1a65b5697ccf0d0217
SHA2561c77c5ee1ca58fcc263739ebb1912fd5ef3f234960123132695646f793e9c202
SHA5122ae457093a18d3427804f36b21377e5f2fc5529a4e00e74b97ef106fae4783247c7b97b02808b089baeb5bda6252fca4cdf72ef66141f6269ceb97b1cbf6a321
-
memory/828-57-0x0000000000000000-mapping.dmp
-
memory/828-61-0x0000000074230000-0x00000000747DB000-memory.dmpFilesize
5.7MB
-
memory/828-65-0x0000000074230000-0x00000000747DB000-memory.dmpFilesize
5.7MB
-
memory/1120-63-0x0000000000000000-mapping.dmp
-
memory/1516-54-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/1516-55-0x0000000074230000-0x00000000747DB000-memory.dmpFilesize
5.7MB
-
memory/1516-62-0x0000000074230000-0x00000000747DB000-memory.dmpFilesize
5.7MB