njrat | db2525eb120cddd924084eb2d3adada700a65066f46f6c3675e47377ef09ee20

General

Target

bJHtVihBXXacserver.js
Size

70KB
MD5

3fb233467088b6906ae7ea8002352e86
SHA1

7f318b6db9a28e39bd0162945295f787956eba61
SHA256

db2525eb120cddd924084eb2d3adada700a65066f46f6c3675e47377ef09ee20
SHA512

e36763c44d0c1e46a986299e3499d476e6e920e8c6d8e704c832457d0ff7725dfa3f29944025a3c9b4205234e285bfdbb69c281f22e1945bcda6094488824cd2

Score

10^/10

njrat vjw0rm hacked by mustymoney evasion persistence spyware stealer suricata trojan worm

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed By MustyMoney

C2

104.168.7.110:5552

Mutex

72f64d4ec723544c65ffca1cd7ba4ee6

Attributes

reg_key
72f64d4ec723544c65ffca1cd7ba4ee6
splitter
|'|'|

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
suricata

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exeWScript.exe

flow	pid	process
5	2000	wscript.exe
17	2000	wscript.exe
20	2000	wscript.exe
24	2000	wscript.exe
39	2000	wscript.exe
44	2000	wscript.exe
45	2000	wscript.exe
46	2000	wscript.exe
49	2000	wscript.exe
50	2000	wscript.exe
52	2000	wscript.exe
53	2000	wscript.exe
54	2000	wscript.exe
56	3000	WScript.exe
57	2000	wscript.exe
58	3000	WScript.exe

Executes dropped EXE 1 IoCs

Processes:

Server.exe

pid process

2512 Server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4948 netsh.exe

pid	process
2512	Server.exe

pid	process
4948	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exeServer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Server.exe

Drops startup file 4 IoCs

Processes:

WScript.exewscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmpF94F.tmp.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JoLUomOYJp.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JoLUomOYJp.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmpF94F.tmp.vbs	WScript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Server.exeWScript.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tmpF94F = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpF94F.tmp.vbs\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tmpF94F = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpF94F.tmp.vbs\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\JoLUomOYJp.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

Server.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings Server.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Server.exe

pid process

2512 Server.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	Server.exe

pid	process
2512	Server.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe
Token: 33	2512	Server.exe
Token: SeIncBasePriorityPrivilege	2512	Server.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

wscript.exeServer.exe

description	pid	process	target process
PID 2184 wrote to memory of 2000	2184	wscript.exe	wscript.exe
PID 2184 wrote to memory of 2000	2184	wscript.exe	wscript.exe
PID 2184 wrote to memory of 2512	2184	wscript.exe	Server.exe
PID 2184 wrote to memory of 2512	2184	wscript.exe	Server.exe
PID 2512 wrote to memory of 4948	2512	Server.exe	netsh.exe
PID 2512 wrote to memory of 4948	2512	Server.exe	netsh.exe
PID 2512 wrote to memory of 3000	2512	Server.exe	WScript.exe
PID 2512 wrote to memory of 3000	2512	Server.exe	WScript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\bJHtVihBXXacserver.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\JoLUomOYJp.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2000

C:\Users\Admin\AppData\Roaming\Server.exe
"C:\Users\Admin\AppData\Roaming\Server.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Server.exe" "Server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:4948

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tmpF94F.tmp.vbs"
3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF94F.tmp.vbs
Filesize
24KB

MD5
e5c1dda5ea4a32f330a5c18582e151f9

SHA1
b1330ee206fc1eab7baf4002080f4b66ff047696

SHA256
3c6ed7bec65ed875a7c4df525b1bb9f4c7dd63727816c02ba41d0571fe48aad2

SHA512
0012d3189984839beba89b15460104462f62e1331181ddf05a6ad1cfb6593812bb497cca11eb539d13cd716028298236eb0eda9afa837a6b1a20b400822a4459

Download Submit
C:\Users\Admin\AppData\Roaming\JoLUomOYJp.js
Filesize
10KB

MD5
842ee98d7d2297a880d610c2d478a911

SHA1
873896b313f12e0bb8b3b5952da49ef4fe6504e1

SHA256
d51918e77450ea07c010890a86da1899e24dd9a5ea46d8a1b73cb8854b805ee6

SHA512
1ffdc072051f3217162e850a80beede604f135f442ce8c28b0f7e6b1499fa8c1dca91c5f76741aae69543bf5cf42da613393bfb336cad1d0dffd0fbceaf97203

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
memory/2000-130-0x0000000000000000-mapping.dmp

Download
memory/2512-132-0x0000000000000000-mapping.dmp

Download
memory/2512-135-0x0000000000520000-0x000000000052C000-memory.dmp

Filesize
48KB

Download
memory/2512-136-0x00007FFE0F180000-0x00007FFE0FC41000-memory.dmp

Filesize
10.8MB

Download
memory/2512-138-0x00007FFE0F180000-0x00007FFE0FC41000-memory.dmp

Filesize
10.8MB

Download
memory/3000-139-0x0000000000000000-mapping.dmp

Download
memory/4948-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads