njrat | 531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098

General

Target

531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe
Size

2.1MB
MD5

d59ee7e723f06f5a8b7c09f9a94ec374
SHA1

a25f9abd250c23113cf546f44528f2e7c30eb937
SHA256

531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098
SHA512

e45f3b1cf906e4a67e2332988adcaf63dbc6e86e4c8986d13591819207e4319bb86b91ac4dd6a4525e6b04284edcf48f2fcb48ee4277b7238406e53f7e8b0cf7

Score

10^/10

njrat driver1.exe evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

driver1.exe

C2

192.168.42.254:5552

Mutex

e36079b13f58a4249aa31dc3586b04c8

Attributes

reg_key
e36079b13f58a4249aa31dc3586b04c8
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

FB8N..exe

pid process

1732 FB8N..exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2000 netsh.exe
Loads dropped DLL 1 IoCs

Processes:

531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe

pid process

1304 531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1368 1304 WerFault.exe 531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1980 taskkill.exe

pid	process
1732	FB8N..exe

pid	process
2000	netsh.exe

pid	process
1304	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe

pid	pid_target	process	target process
1368	1304	WerFault.exe	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe

pid	process
1980	taskkill.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

taskkill.exeFB8N..exe

description	pid	process
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	1732	FB8N..exe
Token: 33	1732	FB8N..exe
Token: SeIncBasePriorityPrivilege	1732	FB8N..exe
Token: 33	1732	FB8N..exe
Token: SeIncBasePriorityPrivilege	1732	FB8N..exe
Token: 33	1732	FB8N..exe
Token: SeIncBasePriorityPrivilege	1732	FB8N..exe
Token: 33	1732	FB8N..exe
Token: SeIncBasePriorityPrivilege	1732	FB8N..exe
Token: 33	1732	FB8N..exe
Token: SeIncBasePriorityPrivilege	1732	FB8N..exe
Token: 33	1732	FB8N..exe
Token: SeIncBasePriorityPrivilege	1732	FB8N..exe
Token: 33	1732	FB8N..exe
Token: SeIncBasePriorityPrivilege	1732	FB8N..exe
Token: 33	1732	FB8N..exe
Token: SeIncBasePriorityPrivilege	1732	FB8N..exe
Token: 33	1732	FB8N..exe
Token: SeIncBasePriorityPrivilege	1732	FB8N..exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exeFB8N..exe

description	pid	process	target process
PID 1304 wrote to memory of 1732	1304	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe	FB8N..exe
PID 1304 wrote to memory of 1732	1304	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe	FB8N..exe
PID 1304 wrote to memory of 1732	1304	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe	FB8N..exe
PID 1304 wrote to memory of 1732	1304	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe	FB8N..exe
PID 1304 wrote to memory of 1368	1304	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe	WerFault.exe
PID 1304 wrote to memory of 1368	1304	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe	WerFault.exe
PID 1304 wrote to memory of 1368	1304	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe	WerFault.exe
PID 1304 wrote to memory of 1368	1304	531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe	WerFault.exe
PID 1732 wrote to memory of 2000	1732	FB8N..exe	netsh.exe
PID 1732 wrote to memory of 2000	1732	FB8N..exe	netsh.exe
PID 1732 wrote to memory of 2000	1732	FB8N..exe	netsh.exe
PID 1732 wrote to memory of 2000	1732	FB8N..exe	netsh.exe
PID 1732 wrote to memory of 1980	1732	FB8N..exe	taskkill.exe
PID 1732 wrote to memory of 1980	1732	FB8N..exe	taskkill.exe
PID 1732 wrote to memory of 1980	1732	FB8N..exe	taskkill.exe
PID 1732 wrote to memory of 1980	1732	FB8N..exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe
"C:\Users\Admin\AppData\Local\Temp\531a83721a2d3ac3b6e5c46cc5d1157f1a16cee8f499ee4f713f1fdddea8a098.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\FB8N..exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\FB8N..exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\FB8N..exe" "FB8N..exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2000

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM avast.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 912
2⤵
- Program crash
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\FB8N..exe
Filesize
341KB

MD5
147a9029be0649b4779312e059fba9d3

SHA1
5bea217a23f6dcb7adff11d78adb10d996c08531

SHA256
ae784656f3641f93a97f26ad0bd9896fbabf8c7c701fd86e76c47544c6e88d77

SHA512
8b1234dda6a9285321b2073f1e06262a6dc9888a06239bbd6ec461f19432fd47c3e7aab7f8f41965973faeb6a10187805397c46077a0e1efda377032bcaac131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\FB8N..exe
Filesize
341KB

MD5
147a9029be0649b4779312e059fba9d3

SHA1
5bea217a23f6dcb7adff11d78adb10d996c08531

SHA256
ae784656f3641f93a97f26ad0bd9896fbabf8c7c701fd86e76c47544c6e88d77

SHA512
8b1234dda6a9285321b2073f1e06262a6dc9888a06239bbd6ec461f19432fd47c3e7aab7f8f41965973faeb6a10187805397c46077a0e1efda377032bcaac131

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\FB8N..exe
Filesize
341KB

MD5
147a9029be0649b4779312e059fba9d3

SHA1
5bea217a23f6dcb7adff11d78adb10d996c08531

SHA256
ae784656f3641f93a97f26ad0bd9896fbabf8c7c701fd86e76c47544c6e88d77

SHA512
8b1234dda6a9285321b2073f1e06262a6dc9888a06239bbd6ec461f19432fd47c3e7aab7f8f41965973faeb6a10187805397c46077a0e1efda377032bcaac131

Download Submit
memory/1304-54-0x0000000000F60000-0x000000000117A000-memory.dmp

Filesize
2.1MB

Download
memory/1304-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1368-60-0x0000000000000000-mapping.dmp

Download
memory/1732-57-0x0000000000000000-mapping.dmp

Download
memory/1732-62-0x00000000719D0000-0x0000000071F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1732-65-0x00000000719D0000-0x0000000071F7B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-64-0x0000000000000000-mapping.dmp

Download
memory/2000-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing