njrat | bbea6ebf291353c5454e9d7890175e419d6daea230704d73e5feb29f0cb7fe71

General

Target

Cheque.js
Size

70KB
MD5

014b70904cf3099e1437403387529b54
SHA1

930859383b24df5f0321096819f5eb96a97755e9
SHA256

bbea6ebf291353c5454e9d7890175e419d6daea230704d73e5feb29f0cb7fe71
SHA512

566b238574e35a65fa9ba86f5708e6847c5576ccee0a5b1dc47404fdb24c70bf8c87a159be5145d988195b518ca7b85dfd5464e779939b9901f5f02c46c1b689

Score

10^/10

njrat vjw0rm hacked by mustymoney evasion persistence suricata trojan worm

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed By MustyMoney

C2

104.168.7.110:5552

Mutex

72f64d4ec723544c65ffca1cd7ba4ee6

Attributes

reg_key
72f64d4ec723544c65ffca1cd7ba4ee6
splitter
|'|'|

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata

Blocklisted process makes network request 10 IoCs

Processes:

wscript.exe

flow	pid	process
2	1872	wscript.exe
6	1872	wscript.exe
7	1872	wscript.exe
15	1872	wscript.exe
24	1872	wscript.exe
25	1872	wscript.exe
40	1872	wscript.exe
43	1872	wscript.exe
46	1872	wscript.exe
52	1872	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

Server.exe

pid process

800 Server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4228 netsh.exe

pid	process
800	Server.exe

pid	process
4228	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\erOsYaZFkd.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\erOsYaZFkd.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exeServer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\erOsYaZFkd.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Server.exe

pid process

800 Server.exe

pid	process
800	Server.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe
Token: 33	800	Server.exe
Token: SeIncBasePriorityPrivilege	800	Server.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exeServer.exe

description	pid	process	target process
PID 4204 wrote to memory of 1872	4204	wscript.exe	wscript.exe
PID 4204 wrote to memory of 1872	4204	wscript.exe	wscript.exe
PID 4204 wrote to memory of 800	4204	wscript.exe	Server.exe
PID 4204 wrote to memory of 800	4204	wscript.exe	Server.exe
PID 800 wrote to memory of 4228	800	Server.exe	netsh.exe
PID 800 wrote to memory of 4228	800	Server.exe	netsh.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Cheque.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4204

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\erOsYaZFkd.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1872

C:\Users\Admin\AppData\Roaming\Server.exe
"C:\Users\Admin\AppData\Roaming\Server.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Server.exe" "Server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:4228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
C:\Users\Admin\AppData\Roaming\erOsYaZFkd.js
Filesize
10KB

MD5
ca226b3fdeada41e1f2743e12442cbae

SHA1
454a44a1884153832370dfa7f3f35f784ed405af

SHA256
d89c5e9d3a60907af391cf5b10840ba2646251f12342e7e9e80d2a1e0acc9845

SHA512
7036ec02decd3ed65d14b8a3f771c492aa67ae59e454d5e24f1dd2c394e6372bc4333966840b629d1f6968c77e7e2186992ff77e3c6dd911ddad9125fe121dcb

Download Submit
memory/800-132-0x0000000000000000-mapping.dmp

Download
memory/800-135-0x0000000000180000-0x000000000018C000-memory.dmp

Filesize
48KB

Download
memory/800-136-0x00007FFADD5D0000-0x00007FFADE091000-memory.dmp

Filesize
10.8MB

Download
memory/800-137-0x00007FFADD5D0000-0x00007FFADE091000-memory.dmp

Filesize
10.8MB

Download
memory/1872-130-0x0000000000000000-mapping.dmp

Download
memory/4228-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads