njrat | d615e5ee56ba34e06f8ca0c30e207578b4762da50d422fb3b07b56eb4e7807ea

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2022, 11:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BrawlStars.exe
Size 1.5MB
Sample220716-nqlj5sbef2
SHA256 d615e5ee56ba34e06f8ca0c30e207578b4762da50d422fb3b07b56eb4e7807ea
MD5 7e63e5ea604dfebe160cf6bacb034080
SHA1 5c5bcc527bd6b800ed88158f2c3faa44da741aee
SHA512 67501d8a2e86b5a28d1fafad9afdbefbc7b8e67bd92f588202f97c057ee4f52964d2efd42e221b32612dfc0483fe28e97de0f1f77a06aa95cd2a9338711b1858
MD5 SHA1 SHA512

Score

10^/10

njrat hacked discovery evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

5.tcp.eu.ngrok.io:12592

Mutex

1c7947be55b45856197461d5c21b4db2

Attributes

reg_key
1c7947be55b45856197461d5c21b4db2
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 3 IoCs

pid	Process
404	lau.exe
4292	LDPlayer4_ru_6029_ld.exe
580	system.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4236	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	BrawlStars.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	lau.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c7947be55b45856197461d5c21b4db2.exe	system.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c7947be55b45856197461d5c21b4db2.exe	system.exe

Loads dropped DLL 3 IoCs

pid	Process
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1c7947be55b45856197461d5c21b4db2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\system.exe\" .."	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1c7947be55b45856197461d5c21b4db2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\system.exe\" .."	system.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	LDPlayer4_ru_6029_ld.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV	LDPlayer4_ru_6029_ld.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	LDPlayer4_ru_6029_ld.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	LDPlayer4_ru_6029_ld.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	system.exe
File opened for modification	C:\autorun.inf	system.exe
File created	D:\autorun.inf	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
564	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
4292	LDPlayer4_ru_6029_ld.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe
580	system.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
580	system.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	LDPlayer4_ru_6029_ld.exe
Token: SeShutdownPrivilege	4292	LDPlayer4_ru_6029_ld.exe
Token: SeCreatePagefilePrivilege	4292	LDPlayer4_ru_6029_ld.exe
Token: SeDebugPrivilege	580	system.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe
Token: 33	580	system.exe
Token: SeIncBasePriorityPrivilege	580	system.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4292	LDPlayer4_ru_6029_ld.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 404	4516	BrawlStars.exe	77
PID 4516 wrote to memory of 404	4516	BrawlStars.exe	77
PID 4516 wrote to memory of 404	4516	BrawlStars.exe	77
PID 4516 wrote to memory of 4292	4516	BrawlStars.exe	79
PID 4516 wrote to memory of 4292	4516	BrawlStars.exe	79
PID 4516 wrote to memory of 4292	4516	BrawlStars.exe	79
PID 404 wrote to memory of 580	404	lau.exe	80
PID 404 wrote to memory of 580	404	lau.exe	80
PID 404 wrote to memory of 580	404	lau.exe	80
PID 580 wrote to memory of 4236	580	system.exe	81
PID 580 wrote to memory of 4236	580	system.exe	81
PID 580 wrote to memory of 4236	580	system.exe	81
PID 580 wrote to memory of 564	580	system.exe	83
PID 580 wrote to memory of 564	580	system.exe	83
PID 580 wrote to memory of 564	580	system.exe	83

C:\Users\Admin\AppData\Local\Temp\BrawlStars.exe
"C:\Users\Admin\AppData\Local\Temp\BrawlStars.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\lau.exe
  "C:\Users\Admin\AppData\Local\Temp\lau.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Users\Admin\AppData\Roaming\system.exe
    "C:\Users\Admin\AppData\Roaming\system.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Drops autorun.inf file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:580
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\system.exe" "system.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:4236
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Exsample.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:564
- C:\Users\Admin\AppData\Local\Temp\LDPlayer4_ru_6029_ld.exe
  "C:\Users\Admin\AppData\Local\Temp\LDPlayer4_ru_6029_ld.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LDPlayer4_ru_6029_ld.exe

Path C:\Users\Admin\AppData\Local\Temp\LDPlayer4_ru_6029_ld.exe
Size 3.2MB
SHA256 81d727fad8ac4fc925ac7ea6678d1a537269da092a6918d1caaa59cebc81c525
MD5 4d8a60c6e654bd38212cebf3d17e5d38
SHA1 9911ab18310d400ba4698a97c591e3893a7e3400
SHA512 cdcf9e75843019a0291af3ee5b1b0aa8fbe655112a7835b8b45331f79ea9a6ec01290e9f523c2b6781cca88006cbfe14bb1076d178f3d49767965924db062d2c
SSDEEP 49152:jXRnyhw3Us74CvY1UjAbDiYppI4ubHDcaR9sXafgkDFMVR9C1UhPJXMK701hOHZJ:jVmZs7y1U8pp/6D4BiCV2Hib
MD5 SHA1 SHA512 SSDEEP

Submit Download

LDPlayer4_ru_6029_ld.exe

Path C:\Users\Admin\AppData\Local\Temp\LDPlayer4_ru_6029_ld.exe
Size 3.2MB
SHA256 81d727fad8ac4fc925ac7ea6678d1a537269da092a6918d1caaa59cebc81c525
MD5 4d8a60c6e654bd38212cebf3d17e5d38
SHA1 9911ab18310d400ba4698a97c591e3893a7e3400
SHA512 cdcf9e75843019a0291af3ee5b1b0aa8fbe655112a7835b8b45331f79ea9a6ec01290e9f523c2b6781cca88006cbfe14bb1076d178f3d49767965924db062d2c
SSDEEP 49152:jXRnyhw3Us74CvY1UjAbDiYppI4ubHDcaR9sXafgkDFMVR9C1UhPJXMK701hOHZJ:jVmZs7y1U8pp/6D4BiCV2Hib
MD5 SHA1 SHA512 SSDEEP

Submit Download

ds.dll

Path C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
Size 62KB
SHA256 305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e
MD5 2204cba332566d808353f256bd211595
SHA1 8da4d578601335c86a3c0b432d37011da316b6cc
SHA512 ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a
SSDEEP 768:z23A2DSSdh1uT+2r2tNQNyYMDuCxrb2E2EHLi6o2LjN+/BvSKheYih79CYih79pg:z8PDNhc/rU/h2EZHFL6vS57h9C7h96
MD5 SHA1 SHA512 SSDEEP

Submit Download

ds.dll

Path C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
Size 62KB
SHA256 305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e
MD5 2204cba332566d808353f256bd211595
SHA1 8da4d578601335c86a3c0b432d37011da316b6cc
SHA512 ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a
SSDEEP 768:z23A2DSSdh1uT+2r2tNQNyYMDuCxrb2E2EHLi6o2LjN+/BvSKheYih79CYih79pg:z8PDNhc/rU/h2EZHFL6vS57h9C7h96
MD5 SHA1 SHA512 SSDEEP

Submit Download

ds.dll

Path C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
Size 62KB
SHA256 305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e
MD5 2204cba332566d808353f256bd211595
SHA1 8da4d578601335c86a3c0b432d37011da316b6cc
SHA512 ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a
SSDEEP 768:z23A2DSSdh1uT+2r2tNQNyYMDuCxrb2E2EHLi6o2LjN+/BvSKheYih79CYih79pg:z8PDNhc/rU/h2EZHFL6vS57h9C7h96
MD5 SHA1 SHA512 SSDEEP

Submit Download

lau.exe

Path C:\Users\Admin\AppData\Local\Temp\lau.exe
Size 37KB
SHA256 cf21599bdf338be9102b5b6df4180b0673855d89ecbf99f6fdb30943da4e7dc4
MD5 67188b529c618802561ff131dad6af1f
SHA1 1e542dbd578aa6ab7b66321f685b64b459ec17d8
SHA512 a0f27d54d9104bc3043a5a46a8d5c6f1e44e3d39c30a54b970ff5728b6691ada064c3128c142d2ea45d0c13140688a26c2eb9aafdcb13f8e5226dfa96c88a082
SSDEEP 384:+MmBkiyJnDNGRn5IyUvwIFvthI/im1xbrAF+rMRTyN/0L+EcoinblneHQM3epzX9:9h5M5jUvFFwqmPrM+rMRa8Nujht
MD5 SHA1 SHA512 SSDEEP

Submit Download

lau.exe

Path C:\Users\Admin\AppData\Local\Temp\lau.exe
Size 37KB
SHA256 cf21599bdf338be9102b5b6df4180b0673855d89ecbf99f6fdb30943da4e7dc4
MD5 67188b529c618802561ff131dad6af1f
SHA1 1e542dbd578aa6ab7b66321f685b64b459ec17d8
SHA512 a0f27d54d9104bc3043a5a46a8d5c6f1e44e3d39c30a54b970ff5728b6691ada064c3128c142d2ea45d0c13140688a26c2eb9aafdcb13f8e5226dfa96c88a082
SSDEEP 384:+MmBkiyJnDNGRn5IyUvwIFvthI/im1xbrAF+rMRTyN/0L+EcoinblneHQM3epzX9:9h5M5jUvFFwqmPrM+rMRa8Nujht
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Users\Admin\AppData\Roaming\system.exe
Size 37KB
SHA256 cf21599bdf338be9102b5b6df4180b0673855d89ecbf99f6fdb30943da4e7dc4
MD5 67188b529c618802561ff131dad6af1f
SHA1 1e542dbd578aa6ab7b66321f685b64b459ec17d8
SHA512 a0f27d54d9104bc3043a5a46a8d5c6f1e44e3d39c30a54b970ff5728b6691ada064c3128c142d2ea45d0c13140688a26c2eb9aafdcb13f8e5226dfa96c88a082
SSDEEP 384:+MmBkiyJnDNGRn5IyUvwIFvthI/im1xbrAF+rMRTyN/0L+EcoinblneHQM3epzX9:9h5M5jUvFFwqmPrM+rMRa8Nujht
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Users\Admin\AppData\Roaming\system.exe
Size 37KB
SHA256 cf21599bdf338be9102b5b6df4180b0673855d89ecbf99f6fdb30943da4e7dc4
MD5 67188b529c618802561ff131dad6af1f
SHA1 1e542dbd578aa6ab7b66321f685b64b459ec17d8
SHA512 a0f27d54d9104bc3043a5a46a8d5c6f1e44e3d39c30a54b970ff5728b6691ada064c3128c142d2ea45d0c13140688a26c2eb9aafdcb13f8e5226dfa96c88a082
SSDEEP 384:+MmBkiyJnDNGRn5IyUvwIFvthI/im1xbrAF+rMRTyN/0L+EcoinblneHQM3epzX9:9h5M5jUvFFwqmPrM+rMRa8Nujht
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-137-0x0000000072C90000-0x0000000073241000-memory.dmp

Download

memory/404-149-0x0000000072C90000-0x0000000073241000-memory.dmp

Download

memory/580-153-0x0000000072C90000-0x0000000073241000-memory.dmp

Download

memory/580-150-0x0000000072C90000-0x0000000073241000-memory.dmp

Download

memory/4292-142-0x00000000089F0000-0x0000000008A82000-memory.dmp

Download

memory/4292-145-0x000000000A050000-0x000000000A57C000-memory.dmp

Download

memory/4292-144-0x0000000009AB0000-0x0000000009B16000-memory.dmp

Download

memory/4292-143-0x0000000009A10000-0x0000000009AAC000-memory.dmp

Download

memory/4292-141-0x0000000008F00000-0x00000000094A4000-memory.dmp

Download

memory/4292-140-0x0000000071770000-0x0000000071784000-memory.dmp

Download