njrat | 34a26cda7f0251648bbc5c791ff2e27eb66162463bdc73799a9afe05d53f7ae2

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2022 01:08

Target

bDJV.exe
Size

23KB
MD5

495b1cad7d009024ca97d9d508f66e21
SHA1

0934b0aa893374169df0bf46edf03ee15239b8d6
SHA256

34a26cda7f0251648bbc5c791ff2e27eb66162463bdc73799a9afe05d53f7ae2
SHA512

b9d061b16f4178138af4e4a3f1930132bd256bbfc8ae4c2e2c039d7a2d2b229801cc3effd45c3fd5bf1300642d5839dae4c6f1405b06aa7c8adee32df0f621d4

Score

10^/10

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4184 netsh.exe

pid	process
4184	netsh.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

bDJV.exe

description	pid	process
Token: SeDebugPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe
Token: 33	3580	bDJV.exe
Token: SeIncBasePriorityPrivilege	3580	bDJV.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bDJV.exe

description	pid	process	target process
PID 3580 wrote to memory of 4184	3580	bDJV.exe	netsh.exe
PID 3580 wrote to memory of 4184	3580	bDJV.exe	netsh.exe
PID 3580 wrote to memory of 4184	3580	bDJV.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\bDJV.exe
"C:\Users\Admin\AppData\Local\Temp\bDJV.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\bDJV.exe" "bDJV.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:4184

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3580-130-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/3580-132-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/4184-131-0x0000000000000000-mapping.dmp

Download