njrat | 28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c

General

Target

28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe
Size

93KB
MD5

ad5ffd5268a01b519b539f1233b52fee
SHA1

1dde3b4a1c4b9b1ac753d649bf16f14744331e39
SHA256

28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c
SHA512

f73539047ac22ec1e3c1dd73401116b35cb43d305229f2c3bbc1ba89f1129fd05db8cb8db4bda7c8ac4970bc07fdb578568d80aa4e1bdaec319530f31ea32bd1

Score

10^/10

njrat hacker evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hacker

C2

FRANSESCOTI3LjAuFRANSESCOC4x:MTYwNA==

Mutex

dfd6ed83b13338db2ca4f209d9a7474f

Attributes

reg_key
dfd6ed83b13338db2ca4f209d9a7474f
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

108 server.exe
Modifies Windows Firewall 1 TTPs 3 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exe

pid process

684 netsh.exe
900 netsh.exe
1528 netsh.exe

pid	process
684	netsh.exe
900	netsh.exe
1528	netsh.exe

Drops startup file 4 IoCs

Processes:

server.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dfd6ed83b13338db2ca4f209d9a7474fWindows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dfd6ed83b13338db2ca4f209d9a7474fWindows Update.exe	server.exe

Loads dropped DLL 2 IoCs

Processes:

28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe

pid	process
1864	28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe
1864	28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

server.exe

pid	process
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe
108	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

server.exe

pid process

108 server.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe
Token: 33	108	server.exe
Token: SeIncBasePriorityPrivilege	108	server.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exeserver.exe

description	pid	process	target process
PID 1864 wrote to memory of 108	1864	28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe	server.exe
PID 1864 wrote to memory of 108	1864	28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe	server.exe
PID 1864 wrote to memory of 108	1864	28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe	server.exe
PID 1864 wrote to memory of 108	1864	28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe	server.exe
PID 108 wrote to memory of 1528	108	server.exe	netsh.exe
PID 108 wrote to memory of 1528	108	server.exe	netsh.exe
PID 108 wrote to memory of 1528	108	server.exe	netsh.exe
PID 108 wrote to memory of 1528	108	server.exe	netsh.exe
PID 108 wrote to memory of 684	108	server.exe	netsh.exe
PID 108 wrote to memory of 684	108	server.exe	netsh.exe
PID 108 wrote to memory of 684	108	server.exe	netsh.exe
PID 108 wrote to memory of 684	108	server.exe	netsh.exe
PID 108 wrote to memory of 900	108	server.exe	netsh.exe
PID 108 wrote to memory of 900	108	server.exe	netsh.exe
PID 108 wrote to memory of 900	108	server.exe	netsh.exe
PID 108 wrote to memory of 900	108	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe
"C:\Users\Admin\AppData\Local\Temp\28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\AppData\Roaming\server.exe
"C:\Users\Admin\AppData\Roaming\server.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1528

C:\Windows\SysWOW64\netsh.exe
netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
3⤵
- Modifies Windows Firewall
PID:684

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:900

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\app
Filesize
4B

MD5
5fa01e3399c29de16299d5f4ac743fb2

SHA1
04e29a03c4a56cf097701f34d6d2999b93035327

SHA256
6918b0e9f3af6051db0828a0ec9b353222b84164dab5ed3c85310eefce166223

SHA512
5492642165fb12e782f71ba84e8a673ecc047a8a8b3f2f59b64fa8200212326d36ed576fd119ffd0134f1daa03d14069ead81f0e29c2d59de10cdf4bbf2dc90c

Download Submit
C:\Users\Admin\AppData\Roaming\server.exe
Filesize
93KB

MD5
ad5ffd5268a01b519b539f1233b52fee

SHA1
1dde3b4a1c4b9b1ac753d649bf16f14744331e39

SHA256
28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c

SHA512
f73539047ac22ec1e3c1dd73401116b35cb43d305229f2c3bbc1ba89f1129fd05db8cb8db4bda7c8ac4970bc07fdb578568d80aa4e1bdaec319530f31ea32bd1

Download Submit
C:\Users\Admin\AppData\Roaming\server.exe
Filesize
93KB

MD5
ad5ffd5268a01b519b539f1233b52fee

SHA1
1dde3b4a1c4b9b1ac753d649bf16f14744331e39

SHA256
28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c

SHA512
f73539047ac22ec1e3c1dd73401116b35cb43d305229f2c3bbc1ba89f1129fd05db8cb8db4bda7c8ac4970bc07fdb578568d80aa4e1bdaec319530f31ea32bd1

Download Submit
\Users\Admin\AppData\Roaming\server.exe
Filesize
93KB

MD5
ad5ffd5268a01b519b539f1233b52fee

SHA1
1dde3b4a1c4b9b1ac753d649bf16f14744331e39

SHA256
28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c

SHA512
f73539047ac22ec1e3c1dd73401116b35cb43d305229f2c3bbc1ba89f1129fd05db8cb8db4bda7c8ac4970bc07fdb578568d80aa4e1bdaec319530f31ea32bd1

Download Submit
\Users\Admin\AppData\Roaming\server.exe
Filesize
93KB

MD5
ad5ffd5268a01b519b539f1233b52fee

SHA1
1dde3b4a1c4b9b1ac753d649bf16f14744331e39

SHA256
28d9c94fe4df6182e2a59cd806837ea242dd7971a44cc6f132220ab45e3ec27c

SHA512
f73539047ac22ec1e3c1dd73401116b35cb43d305229f2c3bbc1ba89f1129fd05db8cb8db4bda7c8ac4970bc07fdb578568d80aa4e1bdaec319530f31ea32bd1

Download Submit
memory/108-58-0x0000000000000000-mapping.dmp

Download
memory/108-64-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/108-71-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/684-67-0x0000000000000000-mapping.dmp

Download
memory/900-68-0x0000000000000000-mapping.dmp

Download
memory/1528-65-0x0000000000000000-mapping.dmp

Download
memory/1864-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1864-62-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download
memory/1864-55-0x0000000074AC0000-0x000000007506B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads