General

  • Target

    Server.exe

  • Size

    36KB

  • Sample

    220613-lcmh6sbdb5

  • MD5

    5fac7c4b8512fe35e5282ad2645a78ec

  • SHA1

    ecb53381d5e9744e5dd9d4a8dbd70cae92ca3379

  • SHA256

    6c834041f5fdd1baf99123f6154cbfd54b1db4bf993d42dfe8a6e25702dd8d1e

  • SHA512

    ce20409e0d22b36cb9f78091151e2df8017284ac31da9b19a6ee0a5e6a11d217d000e8ecca372e9982688212cb882ec2e3911fb4409377b05646aa0bf5ebaccc

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

4.tcp.eu.ngrok.io:15404

Mutex

36c1c9c1013378697034f432be0b8536

Attributes
  • reg_key

    36c1c9c1013378697034f432be0b8536

  • splitter

    |'|'|

Extracted

Family

njrat

Version

im523

Botnet

popka

C2

185.204.1.236:8648

Mutex

73669228637201240c020112fc761ef3

Attributes
  • reg_key

    73669228637201240c020112fc761ef3

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      36KB

    • MD5

      5fac7c4b8512fe35e5282ad2645a78ec

    • SHA1

      ecb53381d5e9744e5dd9d4a8dbd70cae92ca3379

    • SHA256

      6c834041f5fdd1baf99123f6154cbfd54b1db4bf993d42dfe8a6e25702dd8d1e

    • SHA512

      ce20409e0d22b36cb9f78091151e2df8017284ac31da9b19a6ee0a5e6a11d217d000e8ecca372e9982688212cb882ec2e3911fb4409377b05646aa0bf5ebaccc

    • Detect Neshta Payload

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Process Listing)

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Persistence

Change Default File Association

1
T1042

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Data from Local System

1
T1005

Tasks