njrat | 6eacb035edac06e5cefb1e070b3ed350b0c33090f48ba4e34fd920454eb61729

General

Target

bJHtVihBXX_acserver.js
Size

70KB
MD5

3fb233467088b6906ae7ea8002352e86
SHA1

7f318b6db9a28e39bd0162945295f787956eba61
SHA256

db2525eb120cddd924084eb2d3adada700a65066f46f6c3675e47377ef09ee20
SHA512

e36763c44d0c1e46a986299e3499d476e6e920e8c6d8e704c832457d0ff7725dfa3f29944025a3c9b4205234e285bfdbb69c281f22e1945bcda6094488824cd2

Score

10^/10

njrat vjw0rm hacked by mustymoney evasion persistence trojan worm

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed By MustyMoney

C2

104.168.7.110:5552

Mutex

72f64d4ec723544c65ffca1cd7ba4ee6

Attributes

reg_key
72f64d4ec723544c65ffca1cd7ba4ee6
splitter
|'|'|

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Blocklisted process makes network request 13 IoCs

Processes:

wscript.exe

flow	pid	process
4	1708	wscript.exe
6	1708	wscript.exe
7	1708	wscript.exe
10	1708	wscript.exe
12	1708	wscript.exe
13	1708	wscript.exe
16	1708	wscript.exe
17	1708	wscript.exe
18	1708	wscript.exe
21	1708	wscript.exe
23	1708	wscript.exe
24	1708	wscript.exe
27	1708	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

Server.exe

pid process

1192 Server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1464 netsh.exe

pid	process
1192	Server.exe

pid	process
1464	netsh.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JoLUomOYJp.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JoLUomOYJp.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Server.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\JoLUomOYJp.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Server.exe

pid process

1192 Server.exe

pid	process
1192	Server.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe
Token: 33	1192	Server.exe
Token: SeIncBasePriorityPrivilege	1192	Server.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

wscript.exeServer.exe

description	pid	process	target process
PID 284 wrote to memory of 1708	284	wscript.exe	wscript.exe
PID 284 wrote to memory of 1708	284	wscript.exe	wscript.exe
PID 284 wrote to memory of 1708	284	wscript.exe	wscript.exe
PID 284 wrote to memory of 1192	284	wscript.exe	Server.exe
PID 284 wrote to memory of 1192	284	wscript.exe	Server.exe
PID 284 wrote to memory of 1192	284	wscript.exe	Server.exe
PID 1192 wrote to memory of 1464	1192	Server.exe	netsh.exe
PID 1192 wrote to memory of 1464	1192	Server.exe	netsh.exe
PID 1192 wrote to memory of 1464	1192	Server.exe	netsh.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\bJHtVihBXX_acserver.js
1⤵
- Suspicious use of WriteProcessMemory
PID:284
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\JoLUomOYJp.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:1708
- C:\Users\Admin\AppData\Roaming\Server.exe
  "C:\Users\Admin\AppData\Roaming\Server.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\system32\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Server.exe" "Server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\JoLUomOYJp.js

Filesize
10KB

MD5
842ee98d7d2297a880d610c2d478a911

SHA1
873896b313f12e0bb8b3b5952da49ef4fe6504e1

SHA256
d51918e77450ea07c010890a86da1899e24dd9a5ea46d8a1b73cb8854b805ee6

SHA512
1ffdc072051f3217162e850a80beede604f135f442ce8c28b0f7e6b1499fa8c1dca91c5f76741aae69543bf5cf42da613393bfb336cad1d0dffd0fbceaf97203

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe

Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe

Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
memory/284-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/1192-57-0x0000000000000000-mapping.dmp

Download
memory/1192-61-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/1464-63-0x0000000000000000-mapping.dmp

Download
memory/1708-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads