njrat | 96fffb7a76f1b3c9073d35f35292f987304538e1e8c7b8b234872a47c94aab0d

General

Target

bJHtVihBXX_acserver.js
Size

70KB
MD5

3fb233467088b6906ae7ea8002352e86
SHA1

7f318b6db9a28e39bd0162945295f787956eba61
SHA256

db2525eb120cddd924084eb2d3adada700a65066f46f6c3675e47377ef09ee20
SHA512

e36763c44d0c1e46a986299e3499d476e6e920e8c6d8e704c832457d0ff7725dfa3f29944025a3c9b4205234e285bfdbb69c281f22e1945bcda6094488824cd2

Score

10^/10

njrat vjw0rm hacked by mustymoney evasion persistence trojan worm

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed By MustyMoney

C2

104.168.7.110:5552

Mutex

72f64d4ec723544c65ffca1cd7ba4ee6

Attributes

reg_key
72f64d4ec723544c65ffca1cd7ba4ee6
splitter
|'|'|

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Blocklisted process makes network request 15 IoCs

Processes:

wscript.exe

flow	pid	process
5	960	wscript.exe
7	960	wscript.exe
8	960	wscript.exe
10	960	wscript.exe
12	960	wscript.exe
13	960	wscript.exe
15	960	wscript.exe
17	960	wscript.exe
18	960	wscript.exe
21	960	wscript.exe
22	960	wscript.exe
23	960	wscript.exe
26	960	wscript.exe
27	960	wscript.exe
29	960	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

Server.exe

pid process

1720 Server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1508 netsh.exe

pid	process
1720	Server.exe

pid	process
1508	netsh.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JoLUomOYJp.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JoLUomOYJp.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exeServer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\JoLUomOYJp.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72f64d4ec723544c65ffca1cd7ba4ee6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Server.exe\" .."	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Server.exe

pid process

1720 Server.exe

pid	process
1720	Server.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	1720	Server.exe
Token: 33	1720	Server.exe
Token: SeIncBasePriorityPrivilege	1720	Server.exe
Token: 33	1720	Server.exe
Token: SeIncBasePriorityPrivilege	1720	Server.exe
Token: 33	1720	Server.exe
Token: SeIncBasePriorityPrivilege	1720	Server.exe
Token: 33	1720	Server.exe
Token: SeIncBasePriorityPrivilege	1720	Server.exe
Token: 33	1720	Server.exe
Token: SeIncBasePriorityPrivilege	1720	Server.exe
Token: 33	1720	Server.exe
Token: SeIncBasePriorityPrivilege	1720	Server.exe
Token: 33	1720	Server.exe
Token: SeIncBasePriorityPrivilege	1720	Server.exe
Token: 33	1720	Server.exe
Token: SeIncBasePriorityPrivilege	1720	Server.exe
Token: 33	1720	Server.exe
Token: SeIncBasePriorityPrivilege	1720	Server.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

wscript.exeServer.exe

description	pid	process	target process
PID 1724 wrote to memory of 960	1724	wscript.exe	wscript.exe
PID 1724 wrote to memory of 960	1724	wscript.exe	wscript.exe
PID 1724 wrote to memory of 960	1724	wscript.exe	wscript.exe
PID 1724 wrote to memory of 1720	1724	wscript.exe	Server.exe
PID 1724 wrote to memory of 1720	1724	wscript.exe	Server.exe
PID 1724 wrote to memory of 1720	1724	wscript.exe	Server.exe
PID 1720 wrote to memory of 1508	1720	Server.exe	netsh.exe
PID 1720 wrote to memory of 1508	1720	Server.exe	netsh.exe
PID 1720 wrote to memory of 1508	1720	Server.exe	netsh.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\bJHtVihBXX_acserver.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\JoLUomOYJp.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:960

C:\Users\Admin\AppData\Roaming\Server.exe
"C:\Users\Admin\AppData\Roaming\Server.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\system32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Server.exe" "Server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\JoLUomOYJp.js
Filesize
10KB

MD5
842ee98d7d2297a880d610c2d478a911

SHA1
873896b313f12e0bb8b3b5952da49ef4fe6504e1

SHA256
d51918e77450ea07c010890a86da1899e24dd9a5ea46d8a1b73cb8854b805ee6

SHA512
1ffdc072051f3217162e850a80beede604f135f442ce8c28b0f7e6b1499fa8c1dca91c5f76741aae69543bf5cf42da613393bfb336cad1d0dffd0fbceaf97203

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe
Filesize
24KB

MD5
c2f4ae9580de684b7651bade5022107a

SHA1
1e3cbb87a009c26d25469b006713a73d20dc2da7

SHA256
9b86135d4413f51f91c65879d2c3377eba9ccfa348f6d882f471f929ca133bb3

SHA512
8af8df4b6a79bf4a02437f40f37d5c830fc4a92d282616e49f942d0440c6151c9ffac3ed8c3a4f64e152589a960c02dc3c2726550673c5a143625bf0116b3579

Download Submit
memory/960-55-0x0000000000000000-mapping.dmp

Download
memory/1508-63-0x0000000000000000-mapping.dmp

Download
memory/1720-57-0x0000000000000000-mapping.dmp

Download
memory/1720-61-0x00000000008E0000-0x00000000008EC000-memory.dmp

Filesize
48KB

Download
memory/1724-54-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads