njrat | db2525eb120cddd924084eb2d3adada700a65066f46f6c3675e47377ef09ee20

General

Target

bJHtVihBXXacserver.js
Size

70KB
MD5

3fb233467088b6906ae7ea8002352e86
SHA1

7f318b6db9a28e39bd0162945295f787956eba61
SHA256

db2525eb120cddd924084eb2d3adada700a65066f46f6c3675e47377ef09ee20
SHA512

e36763c44d0c1e46a986299e3499d476e6e920e8c6d8e704c832457d0ff7725dfa3f29944025a3c9b4205234e285bfdbb69c281f22e1945bcda6094488824cd2

Score

10^/10

njrat vjw0rm hacked by mustemonee hacked by mustymoney evasion persistence spyware stealer suricata trojan worm

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed By MustyMoney

C2

104.168.7.110:5552

Mutex

72f64d4ec723544c65ffca1cd7ba4ee6

Attributes

reg_key
72f64d4ec723544c65ffca1cd7ba4ee6
splitter
|'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed By MusteMonee

C2

104.168.7.110:5553

Mutex

d60c61d273d37cbe8a96dbc7212c0bd5

Attributes

reg_key
d60c61d273d37cbe8a96dbc7212c0bd5
splitter
|'|'|

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
suricata
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)
suricata

Blocklisted process makes network request 26 IoCs

Processes:

wscript.exeWScript.exe

flow	pid	process
4	1640	wscript.exe
6	1640	wscript.exe
7	1640	wscript.exe
9	1640	wscript.exe
12	1640	wscript.exe
15	1640	wscript.exe
19	1640	wscript.exe
24	2028	WScript.exe
25	1640	wscript.exe
27	2028	WScript.exe
29	1640	wscript.exe
32	2028	WScript.exe
35	2028	WScript.exe
36	1640	wscript.exe
40	2028	WScript.exe
42	1640	wscript.exe
45	2028	WScript.exe
48	1640	wscript.exe
51	2028	WScript.exe
53	2028	WScript.exe
55	1640	wscript.exe
58	2028	WScript.exe
61	1640	wscript.exe
63	2028	WScript.exe
66	1640	wscript.exe
69	2028	WScript.exe

Executes dropped EXE 3 IoCs

Processes:

Server.exetmp77DF.tmp.exeserver.exe

pid process

1628 Server.exe
744 tmp77DF.tmp.exe
1064 server.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exe

pid process

2040 netsh.exe
1592 netsh.exe

pid	process
1628	Server.exe
744	tmp77DF.tmp.exe
1064	server.exe

pid	process
2040	netsh.exe
1592	netsh.exe

Drops startup file 4 IoCs

Processes:

WScript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp30B3.tmp.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp30B3.tmp.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JoLUomOYJp.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JoLUomOYJp.js	wscript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exewscript.exeServer.exeserver.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\tmp30B3 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp30B3.tmp.vbs\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tmp30B3 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp30B3.tmp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\JoLUomOYJp.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\d60c61d273d37cbe8a96dbc7212c0bd5 = "\"C:\\Windows\\server.exe\" .."	server.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d60c61d273d37cbe8a96dbc7212c0bd5 = "\"C:\\Windows\\server.exe\" .."	server.exe

Drops file in Windows directory 1 IoCs

Processes:

tmp77DF.tmp.exe

description ioc process

File created C:\Windows\server.exe tmp77DF.tmp.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

Server.exetmp77DF.tmp.exeserver.exe

pid process

1628 Server.exe
744 tmp77DF.tmp.exe
1064 server.exe

description	ioc	process
File created	C:\Windows\server.exe	tmp77DF.tmp.exe

pid	process
1628	Server.exe
744	tmp77DF.tmp.exe
1064	server.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

Server.exeserver.exe

description	pid	process
Token: SeDebugPrivilege	1628	Server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: SeDebugPrivilege	1064	server.exe
Token: 33	1064	server.exe
Token: SeIncBasePriorityPrivilege	1064	server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	1064	server.exe
Token: SeIncBasePriorityPrivilege	1064	server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	1064	server.exe
Token: SeIncBasePriorityPrivilege	1064	server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	1064	server.exe
Token: SeIncBasePriorityPrivilege	1064	server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	1064	server.exe
Token: SeIncBasePriorityPrivilege	1064	server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	1064	server.exe
Token: SeIncBasePriorityPrivilege	1064	server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe
Token: 33	1064	server.exe
Token: SeIncBasePriorityPrivilege	1064	server.exe
Token: 33	1628	Server.exe
Token: SeIncBasePriorityPrivilege	1628	Server.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

wscript.exeServer.exetmp77DF.tmp.exeserver.exe

description	pid	process	target process
PID 1044 wrote to memory of 1640	1044	wscript.exe	wscript.exe
PID 1044 wrote to memory of 1640	1044	wscript.exe	wscript.exe
PID 1044 wrote to memory of 1640	1044	wscript.exe	wscript.exe
PID 1044 wrote to memory of 1628	1044	wscript.exe	Server.exe
PID 1044 wrote to memory of 1628	1044	wscript.exe	Server.exe
PID 1044 wrote to memory of 1628	1044	wscript.exe	Server.exe
PID 1628 wrote to memory of 2040	1628	Server.exe	netsh.exe
PID 1628 wrote to memory of 2040	1628	Server.exe	netsh.exe
PID 1628 wrote to memory of 2040	1628	Server.exe	netsh.exe
PID 1628 wrote to memory of 744	1628	Server.exe	tmp77DF.tmp.exe
PID 1628 wrote to memory of 744	1628	Server.exe	tmp77DF.tmp.exe
PID 1628 wrote to memory of 744	1628	Server.exe	tmp77DF.tmp.exe
PID 744 wrote to memory of 1064	744	tmp77DF.tmp.exe	server.exe
PID 744 wrote to memory of 1064	744	tmp77DF.tmp.exe	server.exe
PID 744 wrote to memory of 1064	744	tmp77DF.tmp.exe	server.exe
PID 1064 wrote to memory of 1592	1064	server.exe	netsh.exe
PID 1064 wrote to memory of 1592	1064	server.exe	netsh.exe
PID 1064 wrote to memory of 1592	1064	server.exe	netsh.exe
PID 1628 wrote to memory of 2028	1628	Server.exe	WScript.exe
PID 1628 wrote to memory of 2028	1628	Server.exe	WScript.exe
PID 1628 wrote to memory of 2028	1628	Server.exe	WScript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\bJHtVihBXXacserver.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\JoLUomOYJp.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1640

C:\Users\Admin\AppData\Roaming\Server.exe
"C:\Users\Admin\AppData\Roaming\Server.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\system32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Server.exe" "Server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2040

C:\Users\Admin\AppData\Local\Temp\tmp77DF.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp77DF.tmp.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\server.exe
"C:\Windows\server.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\system32\netsh.exe
netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
5⤵
- Modifies Windows Firewall
PID:1592

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tmp30B3.tmp.vbs"
3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp30B3.tmp.vbs
Filesize
24KB

MD5
e5c1dda5ea4a32f330a5c18582e151f9

SHA1
b1330ee206fc1eab7baf4002080f4b66ff047696

SHA256
3c6ed7bec65ed875a7c4df525b1bb9f4c7dd63727816c02ba41d0571fe48aad2

SHA512
0012d3189984839beba89b15460104462f62e1331181ddf05a6ad1cfb6593812bb497cca11eb539d13cd716028298236eb0eda9afa837a6b1a20b400822a4459

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp77DF.tmp.exe
Filesize
25KB

MD5
fecca2a34ee4b957a3a4b17b978c0d1d

SHA1
9acc307d70dd60d101d0ed011e2527510b377589

SHA256
143a970a28af33f3b12c77752bc8b2c0c48463f843d265187d50f52db744219c

SHA512
7e1f7c64aae2cbb037a1025e2cbbb8b1eb23a1a5375f333cd9f58c849345f34efc2baf7c45ed00c714f9ca2222d412b02d497d45e012dd3a2a51947684064e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp77DF.tmp.exe
Filesize
25KB

MD5
fecca2a34ee4b957a3a4b17b978c0d1d

SHA1
9acc307d70dd60d101d0ed011e2527510b377589

SHA256
143a970a28af33f3b12c77752bc8b2c0c48463f843d265187d50f52db744219c

SHA512
7e1f7c64aae2cbb037a1025e2cbbb8b1eb23a1a5375f333cd9f58c849345f34efc2baf7c45ed00c714f9ca2222d412b02d497d45e012dd3a2a51947684064e42

Download Submit
C:\Users\Admin\AppData\Roaming\JoLUomOYJp.js
Filesize
10KB

MD5
842ee98d7d2297a880d610c2d478a911

SHA1
873896b313f12e0bb8b3b5952da49ef4fe6504e1

SHA256
d51918e77450ea07c010890a86da1899e24dd9a5ea46d8a1b73cb8854b805ee6

SHA512
1ffdc072051f3217162e850a80beede604f135f442ce8c28b0f7e6b1499fa8c1dca91c5f76741aae69543bf5cf42da613393bfb336cad1d0dffd0fbceaf97203

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
C:\Windows\server.exe
Filesize
25KB

MD5
fecca2a34ee4b957a3a4b17b978c0d1d

SHA1
9acc307d70dd60d101d0ed011e2527510b377589

SHA256
143a970a28af33f3b12c77752bc8b2c0c48463f843d265187d50f52db744219c

SHA512
7e1f7c64aae2cbb037a1025e2cbbb8b1eb23a1a5375f333cd9f58c849345f34efc2baf7c45ed00c714f9ca2222d412b02d497d45e012dd3a2a51947684064e42

Download Submit
C:\Windows\server.exe
Filesize
25KB

MD5
fecca2a34ee4b957a3a4b17b978c0d1d

SHA1
9acc307d70dd60d101d0ed011e2527510b377589

SHA256
143a970a28af33f3b12c77752bc8b2c0c48463f843d265187d50f52db744219c

SHA512
7e1f7c64aae2cbb037a1025e2cbbb8b1eb23a1a5375f333cd9f58c849345f34efc2baf7c45ed00c714f9ca2222d412b02d497d45e012dd3a2a51947684064e42

Download Submit
memory/744-65-0x0000000000000000-mapping.dmp

Download
memory/744-68-0x0000000000C30000-0x0000000000C3C000-memory.dmp

Filesize
48KB

Download
memory/1044-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Filesize
8KB

Download
memory/1064-73-0x00000000009C0000-0x00000000009CC000-memory.dmp

Filesize
48KB

Download
memory/1064-70-0x0000000000000000-mapping.dmp

Download
memory/1592-75-0x0000000000000000-mapping.dmp

Download
memory/1628-57-0x0000000000000000-mapping.dmp

Download
memory/1628-61-0x0000000001280000-0x000000000128C000-memory.dmp

Filesize
48KB

Download
memory/1628-77-0x000000001AD00000-0x000000001AD64000-memory.dmp

Filesize
400KB

Download
memory/1628-79-0x000000001B820000-0x000000001B87E000-memory.dmp

Filesize
376KB

Download
memory/1628-81-0x000000001B880000-0x000000001B900000-memory.dmp

Filesize
512KB

Download
memory/1640-55-0x0000000000000000-mapping.dmp

Download
memory/2028-78-0x0000000000000000-mapping.dmp

Download
memory/2040-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads