njrat | 55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Size

23KB
MD5

eac054b970f4ae77ae5e2d88de8576ec
SHA1

577ade9091355668202d31282005b92621ea38a5
SHA256

55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6
SHA512

fa2129e5911c15151cec78c2860b594467b81dc537bcdeb8d689aa480ff845485129f7066ad97e6a4af50361b3931db2ab26986fdcc8b88b25c1ab78c4fc5c92

Score

10^/10

njrat evasion trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4284 netsh.exe

pid	process
4284	netsh.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe

description	pid	process
Token: SeDebugPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: 33	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
Token: SeIncBasePriorityPrivilege	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe

description	pid	process	target process
PID 4876 wrote to memory of 4284	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe	netsh.exe
PID 4876 wrote to memory of 4284	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe	netsh.exe
PID 4876 wrote to memory of 4284	4876	55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe
"C:\Users\Admin\AppData\Local\Temp\55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe" "55fa513f585b426b8ffedd0f9a2f02dcf66ca7d4476111306ccca9151becbbe6.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:4284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4284-131-0x0000000000000000-mapping.dmp

Download
memory/4876-130-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download
memory/4876-132-0x00000000751D0000-0x0000000075781000-memory.dmp

Filesize
5.7MB

Download