njrat | bbea6ebf291353c5454e9d7890175e419d6daea230704d73e5feb29f0cb7fe71

General

Target

Cheque.js
Size

70KB
MD5

014b70904cf3099e1437403387529b54
SHA1

930859383b24df5f0321096819f5eb96a97755e9
SHA256

bbea6ebf291353c5454e9d7890175e419d6daea230704d73e5feb29f0cb7fe71
SHA512

566b238574e35a65fa9ba86f5708e6847c5576ccee0a5b1dc47404fdb24c70bf8c87a159be5145d988195b518ca7b85dfd5464e779939b9901f5f02c46c1b689

Score

10^/10

njrat vjw0rm hacked by mustymoney evasion persistence suricata trojan worm

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed By MustyMoney

C2

104.168.7.110:5552

Mutex

72f64d4ec723544c65ffca1cd7ba4ee6

Attributes

reg_key
72f64d4ec723544c65ffca1cd7ba4ee6
splitter
|'|'|

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exe

flow	pid	process
5	1348	wscript.exe
7	1348	wscript.exe
8	1348	wscript.exe
10	1348	wscript.exe
11	1348	wscript.exe
12	1348	wscript.exe
14	1348	wscript.exe
15	1348	wscript.exe
16	1348	wscript.exe
18	1348	wscript.exe
19	1348	wscript.exe
20	1348	wscript.exe
22	1348	wscript.exe
23	1348	wscript.exe
24	1348	wscript.exe
26	1348	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

Server.exe

pid process

1284 Server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1932 netsh.exe

pid	process
1284	Server.exe

pid	process
1932	netsh.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\erOsYaZFkd.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\erOsYaZFkd.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exeServer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\erOsYaZFkd.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Server.exe

pid process

1284 Server.exe

pid	process
1284	Server.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	1284	Server.exe
Token: 33	1284	Server.exe
Token: SeIncBasePriorityPrivilege	1284	Server.exe
Token: 33	1284	Server.exe
Token: SeIncBasePriorityPrivilege	1284	Server.exe
Token: 33	1284	Server.exe
Token: SeIncBasePriorityPrivilege	1284	Server.exe
Token: 33	1284	Server.exe
Token: SeIncBasePriorityPrivilege	1284	Server.exe
Token: 33	1284	Server.exe
Token: SeIncBasePriorityPrivilege	1284	Server.exe
Token: 33	1284	Server.exe
Token: SeIncBasePriorityPrivilege	1284	Server.exe
Token: 33	1284	Server.exe
Token: SeIncBasePriorityPrivilege	1284	Server.exe
Token: 33	1284	Server.exe
Token: SeIncBasePriorityPrivilege	1284	Server.exe
Token: 33	1284	Server.exe
Token: SeIncBasePriorityPrivilege	1284	Server.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

wscript.exeServer.exe

description	pid	process	target process
PID 800 wrote to memory of 1348	800	wscript.exe	wscript.exe
PID 800 wrote to memory of 1348	800	wscript.exe	wscript.exe
PID 800 wrote to memory of 1348	800	wscript.exe	wscript.exe
PID 800 wrote to memory of 1284	800	wscript.exe	Server.exe
PID 800 wrote to memory of 1284	800	wscript.exe	Server.exe
PID 800 wrote to memory of 1284	800	wscript.exe	Server.exe
PID 1284 wrote to memory of 1932	1284	Server.exe	netsh.exe
PID 1284 wrote to memory of 1932	1284	Server.exe	netsh.exe
PID 1284 wrote to memory of 1932	1284	Server.exe	netsh.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Cheque.js
1⤵
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\erOsYaZFkd.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1348

C:\Users\Admin\AppData\Roaming\Server.exe
"C:\Users\Admin\AppData\Roaming\Server.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\system32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Server.exe" "Server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
C:\Users\Admin\AppData\Roaming\erOsYaZFkd.js
Filesize
10KB

MD5
ca226b3fdeada41e1f2743e12442cbae

SHA1
454a44a1884153832370dfa7f3f35f784ed405af

SHA256
d89c5e9d3a60907af391cf5b10840ba2646251f12342e7e9e80d2a1e0acc9845

SHA512
7036ec02decd3ed65d14b8a3f771c492aa67ae59e454d5e24f1dd2c394e6372bc4333966840b629d1f6968c77e7e2186992ff77e3c6dd911ddad9125fe121dcb

Download Submit
memory/800-54-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Filesize
8KB

Download
memory/1284-57-0x0000000000000000-mapping.dmp

Download
memory/1284-61-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/1348-55-0x0000000000000000-mapping.dmp

Download
memory/1932-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads