njrat | 36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944

General

Target

36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe
Size

29KB
MD5

13f58dfd117d898323b225c0a5ccc5f4
SHA1

ef333f79c99d1ea871bfa2d25492f205643f589b
SHA256

36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944
SHA512

49637dd7084ae38654d876b000590aca768a4098a159b9b0196580c91494fb534c4e07478740611814288e7a7bd5bdff62691ebc43efd76d8928fc7225cbe763

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

127.0.0.1:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Trojan.exe

pid process

1348 Trojan.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

900 netsh.exe
Loads dropped DLL 1 IoCs

Processes:

36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe

pid process

304 36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe

pid	process
900	netsh.exe

pid	process
304	36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Trojan.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

Trojan.exe

pid	process
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe
1348	Trojan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Trojan.exe

description pid process

Token: SeDebugPrivilege 1348 Trojan.exe

description	pid	process
Token: SeDebugPrivilege	1348	Trojan.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exeTrojan.exe

description	pid	process	target process
PID 304 wrote to memory of 1348	304	36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe	Trojan.exe
PID 304 wrote to memory of 1348	304	36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe	Trojan.exe
PID 304 wrote to memory of 1348	304	36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe	Trojan.exe
PID 304 wrote to memory of 1348	304	36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe	Trojan.exe
PID 1348 wrote to memory of 900	1348	Trojan.exe	netsh.exe
PID 1348 wrote to memory of 900	1348	Trojan.exe	netsh.exe
PID 1348 wrote to memory of 900	1348	Trojan.exe	netsh.exe
PID 1348 wrote to memory of 900	1348	Trojan.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe
"C:\Users\Admin\AppData\Local\Temp\36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:900

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
13f58dfd117d898323b225c0a5ccc5f4

SHA1
ef333f79c99d1ea871bfa2d25492f205643f589b

SHA256
36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944

SHA512
49637dd7084ae38654d876b000590aca768a4098a159b9b0196580c91494fb534c4e07478740611814288e7a7bd5bdff62691ebc43efd76d8928fc7225cbe763

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
13f58dfd117d898323b225c0a5ccc5f4

SHA1
ef333f79c99d1ea871bfa2d25492f205643f589b

SHA256
36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944

SHA512
49637dd7084ae38654d876b000590aca768a4098a159b9b0196580c91494fb534c4e07478740611814288e7a7bd5bdff62691ebc43efd76d8928fc7225cbe763

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
13f58dfd117d898323b225c0a5ccc5f4

SHA1
ef333f79c99d1ea871bfa2d25492f205643f589b

SHA256
36052b2e4d58145d7ea60045bdd5afc10dc168eb9451ef2029511cd929b68944

SHA512
49637dd7084ae38654d876b000590aca768a4098a159b9b0196580c91494fb534c4e07478740611814288e7a7bd5bdff62691ebc43efd76d8928fc7225cbe763

Download Submit
memory/304-54-0x0000000075311000-0x0000000075313000-memory.dmp

Filesize
8KB

Download
memory/304-55-0x0000000074390000-0x000000007493B000-memory.dmp

Filesize
5.7MB

Download
memory/304-61-0x0000000074390000-0x000000007493B000-memory.dmp

Filesize
5.7MB

Download
memory/900-62-0x0000000000000000-mapping.dmp

Download
memory/1348-57-0x0000000000000000-mapping.dmp

Download
memory/1348-63-0x0000000074390000-0x000000007493B000-memory.dmp

Filesize
5.7MB

Download
memory/1348-65-0x0000000074390000-0x000000007493B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads