njrat | 3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11

General

Target

3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe
Size

23KB
MD5

ae6580de80622ab8f17ec97fbd077b56
SHA1

6b8298bcf68fba4c8fd14bb8879e32022beab6cb
SHA256

3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11
SHA512

15d8b03d5ee7aadb60805a5e225962cb26d7aab41a1e67879e3e497c4567ae6b9fd5b7c36506aff7c5c5a3faacc994bc29c723cbf7597e0e04318dfd14444a7a

Score

10^/10

njrat hacked evasion persistence suricata trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hacked

C2

microsoft171.duckdns.org:1337

Mutex

ca01d4d3802379411c71a0ad552be90b

Attributes

reg_key
ca01d4d3802379411c71a0ad552be90b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Executes dropped EXE 1 IoCs

Processes:

igfxZXModule Service.exe

pid process

916 igfxZXModule Service.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1264 netsh.exe

pid	process
916	igfxZXModule Service.exe

pid	process
1264	netsh.exe

Drops startup file 2 IoCs

Processes:

igfxZXModule Service.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ca01d4d3802379411c71a0ad552be90b.exe	igfxZXModule Service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ca01d4d3802379411c71a0ad552be90b.exe	igfxZXModule Service.exe

Loads dropped DLL 1 IoCs

Processes:

3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe

pid process

1664 3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe

pid	process
1664	3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

igfxZXModule Service.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ca01d4d3802379411c71a0ad552be90b = "\"C:\\ProgramData\\igfxZXModule Service.exe\" .."	igfxZXModule Service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ca01d4d3802379411c71a0ad552be90b = "\"C:\\ProgramData\\igfxZXModule Service.exe\" .."	igfxZXModule Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

igfxZXModule Service.exe

description	pid	process
Token: SeDebugPrivilege	916	igfxZXModule Service.exe
Token: 33	916	igfxZXModule Service.exe
Token: SeIncBasePriorityPrivilege	916	igfxZXModule Service.exe
Token: 33	916	igfxZXModule Service.exe
Token: SeIncBasePriorityPrivilege	916	igfxZXModule Service.exe
Token: 33	916	igfxZXModule Service.exe
Token: SeIncBasePriorityPrivilege	916	igfxZXModule Service.exe
Token: 33	916	igfxZXModule Service.exe
Token: SeIncBasePriorityPrivilege	916	igfxZXModule Service.exe
Token: 33	916	igfxZXModule Service.exe
Token: SeIncBasePriorityPrivilege	916	igfxZXModule Service.exe
Token: 33	916	igfxZXModule Service.exe
Token: SeIncBasePriorityPrivilege	916	igfxZXModule Service.exe
Token: 33	916	igfxZXModule Service.exe
Token: SeIncBasePriorityPrivilege	916	igfxZXModule Service.exe
Token: 33	916	igfxZXModule Service.exe
Token: SeIncBasePriorityPrivilege	916	igfxZXModule Service.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exeigfxZXModule Service.exe

description	pid	process	target process
PID 1664 wrote to memory of 916	1664	3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe	igfxZXModule Service.exe
PID 1664 wrote to memory of 916	1664	3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe	igfxZXModule Service.exe
PID 1664 wrote to memory of 916	1664	3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe	igfxZXModule Service.exe
PID 1664 wrote to memory of 916	1664	3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe	igfxZXModule Service.exe
PID 916 wrote to memory of 1264	916	igfxZXModule Service.exe	netsh.exe
PID 916 wrote to memory of 1264	916	igfxZXModule Service.exe	netsh.exe
PID 916 wrote to memory of 1264	916	igfxZXModule Service.exe	netsh.exe
PID 916 wrote to memory of 1264	916	igfxZXModule Service.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe
"C:\Users\Admin\AppData\Local\Temp\3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664

C:\ProgramData\igfxZXModule Service.exe
"C:\ProgramData\igfxZXModule Service.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\ProgramData\igfxZXModule Service.exe" "igfxZXModule Service.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\igfxZXModule Service.exe
Filesize
23KB

MD5
ae6580de80622ab8f17ec97fbd077b56

SHA1
6b8298bcf68fba4c8fd14bb8879e32022beab6cb

SHA256
3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11

SHA512
15d8b03d5ee7aadb60805a5e225962cb26d7aab41a1e67879e3e497c4567ae6b9fd5b7c36506aff7c5c5a3faacc994bc29c723cbf7597e0e04318dfd14444a7a

Download Submit
C:\ProgramData\igfxZXModule Service.exe
Filesize
23KB

MD5
ae6580de80622ab8f17ec97fbd077b56

SHA1
6b8298bcf68fba4c8fd14bb8879e32022beab6cb

SHA256
3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11

SHA512
15d8b03d5ee7aadb60805a5e225962cb26d7aab41a1e67879e3e497c4567ae6b9fd5b7c36506aff7c5c5a3faacc994bc29c723cbf7597e0e04318dfd14444a7a

Download Submit
\ProgramData\igfxZXModule Service.exe
Filesize
23KB

MD5
ae6580de80622ab8f17ec97fbd077b56

SHA1
6b8298bcf68fba4c8fd14bb8879e32022beab6cb

SHA256
3d23047d00544b251210814d5404dd45d8fd7b86b0e7e36320057388aa5e6c11

SHA512
15d8b03d5ee7aadb60805a5e225962cb26d7aab41a1e67879e3e497c4567ae6b9fd5b7c36506aff7c5c5a3faacc994bc29c723cbf7597e0e04318dfd14444a7a

Download Submit
memory/916-58-0x0000000000000000-mapping.dmp

Download
memory/916-63-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/916-66-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1264-64-0x0000000000000000-mapping.dmp

Download
memory/1664-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1664-56-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1664-62-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads