njrat | 3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1

General

Target

3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe
Size

23KB
MD5

6da1b9e34be8401e656dd8a263d1857a
SHA1

c252431527c0aebb9edca387ce9ddb71d2baa311
SHA256

3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1
SHA512

48b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:2222

Mutex

a2e45a7dbc044c98d46693fd415d81b0

Attributes

reg_key
a2e45a7dbc044c98d46693fd415d81b0
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

revenge.exe

pid process

2024 revenge.exe
Loads dropped DLL 1 IoCs

Processes:

3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe

pid process

1720 3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2024	revenge.exe

pid	process
1720	3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe

description	pid	process	target process
PID 1720 wrote to memory of 2024	1720	3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe	revenge.exe
PID 1720 wrote to memory of 2024	1720	3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe	revenge.exe
PID 1720 wrote to memory of 2024	1720	3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe	revenge.exe
PID 1720 wrote to memory of 2024	1720	3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe	revenge.exe

C:\Users\Admin\AppData\Local\Temp\3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe
"C:\Users\Admin\AppData\Local\Temp\3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\revenge.exe
"C:\Users\Admin\AppData\Local\Temp\revenge.exe"
2⤵
- Executes dropped EXE
PID:2024

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\revenge.exe
Filesize
23KB

MD5
6da1b9e34be8401e656dd8a263d1857a

SHA1
c252431527c0aebb9edca387ce9ddb71d2baa311

SHA256
3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1

SHA512
48b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\revenge.exe
Filesize
23KB

MD5
6da1b9e34be8401e656dd8a263d1857a

SHA1
c252431527c0aebb9edca387ce9ddb71d2baa311

SHA256
3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1

SHA512
48b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79

Download Submit
\Users\Admin\AppData\Local\Temp\revenge.exe
Filesize
23KB

MD5
6da1b9e34be8401e656dd8a263d1857a

SHA1
c252431527c0aebb9edca387ce9ddb71d2baa311

SHA256
3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1

SHA512
48b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79

Download Submit
memory/1720-54-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1720-55-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/1720-62-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/1720-64-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/2024-57-0x0000000000000000-mapping.dmp

Download
memory/2024-61-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/2024-63-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing