njrat | bf8b455cc351263446a8a1afc1f2461d2cbcfca273aaa6be24c22afacd6f281a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09/07/2022, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cbfa2e4458747eecb05c8813a94700b2.exe
Size 691KB
Sample220709-mkc55sgcb4
SHA256 bf8b455cc351263446a8a1afc1f2461d2cbcfca273aaa6be24c22afacd6f281a
MD5 cbfa2e4458747eecb05c8813a94700b2
SHA1 77ace1902d0fb55a916fd825a24bd4bfa2527cf4
SHA512 0465c70a4d9409bcfc10f397e3086d96164aac6b777fbb63d9e67b939e22f253e6a3ea11c9323cc3c7a895b0b1bed4d6df3450bae2e47459664aa896ba205c9e
MD5 SHA1 SHA512

Score

10^/10

njrat hacked evasion suricata trojan upx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

OC50Y3Aubmdyb2suaW8Strik:MTM5NTU=

Mutex

60980d59cee45e3b1f98f91557ebf595

Attributes

reg_key
60980d59cee45e3b1f98f91557ebf595
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata

Executes dropped EXE 2 IoCs

pid	Process
3312	Server.exe
3652	HxD.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4468	netsh.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0003000000000727-139.dat	upx
behavioral2/files/0x0003000000000727-140.dat	upx
behavioral2/memory/3652-143-0x0000000000400000-0x00000000005C7000-memory.dmp	upx
behavioral2/memory/3652-146-0x0000000000400000-0x00000000005C7000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	cbfa2e4458747eecb05c8813a94700b2.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.exe	Server.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Discord.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\Discord.exe	Server.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Discord.exe	Server.exe
File opened for modification	C:\Program Files (x86)\Discord.exe	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3312	Server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe
Token: 33	3312	Server.exe
Token: SeIncBasePriorityPrivilege	3312	Server.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3652	HxD.exe
3652	HxD.exe
3652	HxD.exe
3652	HxD.exe
3652	HxD.exe
3652	HxD.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 1364 wrote to memory of 3428	1364	cbfa2e4458747eecb05c8813a94700b2.exe	81
PID 3428 wrote to memory of 3312	3428	cbfa2e4458747eecb05c8813a94700b2.exe	82
PID 3428 wrote to memory of 3312	3428	cbfa2e4458747eecb05c8813a94700b2.exe	82
PID 3428 wrote to memory of 3312	3428	cbfa2e4458747eecb05c8813a94700b2.exe	82
PID 3428 wrote to memory of 3652	3428	cbfa2e4458747eecb05c8813a94700b2.exe	83
PID 3428 wrote to memory of 3652	3428	cbfa2e4458747eecb05c8813a94700b2.exe	83
PID 3428 wrote to memory of 3652	3428	cbfa2e4458747eecb05c8813a94700b2.exe	83
PID 3312 wrote to memory of 4468	3312	Server.exe	84
PID 3312 wrote to memory of 4468	3312	Server.exe	84
PID 3312 wrote to memory of 4468	3312	Server.exe	84

C:\Users\Admin\AppData\Local\Temp\cbfa2e4458747eecb05c8813a94700b2.exe
"C:\Users\Admin\AppData\Local\Temp\cbfa2e4458747eecb05c8813a94700b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\cbfa2e4458747eecb05c8813a94700b2.exe
  "C:\Users\Admin\AppData\Local\Temp\cbfa2e4458747eecb05c8813a94700b2.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Users\Admin\AppData\Local\Temp\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:4468
- - C:\Users\Admin\AppData\Local\Temp\HxD.exe
    "C:\Users\Admin\AppData\Local\Temp\HxD.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HxD.exe

Path C:\Users\Admin\AppData\Local\Temp\HxD.exe
Size 578KB
SHA256 5ac744ed14a4288c3e38bc9aa6825bd214db5ca01f0bbf383755370e64adc638
MD5 9025e136baa3aeb96c0eb8e743fb5dbb
SHA1 4f603fcbbf28dbba341086488c3fc7e4f3eb91b3
SHA512 dc6404ceaf15230ab8299c3159cf52af5f7d9e303f79986ef952f00efced2a72cdc6adbc402469d92e1ab5a09dc918cca7867fb0662757c14b5fbe5574496617
SSDEEP 12288:9rfjdx9KqYsfwkxY6eYmgbW7JyZ0Na6w9+GH1SOKF+rtSUh1oSe:Nbb9F8fYHa78yNwrSDF+L
MD5 SHA1 SHA512 SSDEEP

Submit Download

HxD.exe

Path C:\Users\Admin\AppData\Local\Temp\HxD.exe
Size 578KB
SHA256 5ac744ed14a4288c3e38bc9aa6825bd214db5ca01f0bbf383755370e64adc638
MD5 9025e136baa3aeb96c0eb8e743fb5dbb
SHA1 4f603fcbbf28dbba341086488c3fc7e4f3eb91b3
SHA512 dc6404ceaf15230ab8299c3159cf52af5f7d9e303f79986ef952f00efced2a72cdc6adbc402469d92e1ab5a09dc918cca7867fb0662757c14b5fbe5574496617
SSDEEP 12288:9rfjdx9KqYsfwkxY6eYmgbW7JyZ0Na6w9+GH1SOKF+rtSUh1oSe:Nbb9F8fYHa78yNwrSDF+L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Users\Admin\AppData\Local\Temp\Server.exe
Size 93KB
SHA256 e3c93ec9753c8c2c8d2276a99c34b3fe01bcca2b40b799c573ec9b459b29424f
MD5 6d192d5f2ea6d76de5075c351412fca6
SHA1 284c4d0bee3142b3b4cbef247076ec00cc390000
SHA512 0d5fa6c58af36946cf3aa1b20b3709bd672136939370691f6f6b8aa07433989bfdb6e3c37ea700f863930ca7fc600b7ed32600650fc5c7beeefa1089dadebd36
SSDEEP 1536:Rxr4c+aoKNo3XwOUxi/CfAN11JLxQLgeguVLSU5J0xwK0i30FrY8KOX/Uk54ojET:Rx8XwOUxio4Zi1dl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Users\Admin\AppData\Local\Temp\Server.exe
Size 93KB
SHA256 e3c93ec9753c8c2c8d2276a99c34b3fe01bcca2b40b799c573ec9b459b29424f
MD5 6d192d5f2ea6d76de5075c351412fca6
SHA1 284c4d0bee3142b3b4cbef247076ec00cc390000
SHA512 0d5fa6c58af36946cf3aa1b20b3709bd672136939370691f6f6b8aa07433989bfdb6e3c37ea700f863930ca7fc600b7ed32600650fc5c7beeefa1089dadebd36
SSDEEP 1536:Rxr4c+aoKNo3XwOUxi/CfAN11JLxQLgeguVLSU5J0xwK0i30FrY8KOX/Uk54ojET:Rx8XwOUxio4Zi1dl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3312-145-0x0000000073700000-0x0000000073CB1000-memory.dmp

Download

memory/3312-142-0x0000000073700000-0x0000000073CB1000-memory.dmp

Download

memory/3428-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3428-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3428-141-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3428-132-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3428-131-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3652-143-0x0000000000400000-0x00000000005C7000-memory.dmp

Download

memory/3652-146-0x0000000000400000-0x00000000005C7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads