njrat | a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee

Analysis

max time kernel
156s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Size

23KB
MD5

dd9089cb883348bd95aaac1bd002f0cf
SHA1

ec126ecd96beb4b1f2b9020ec082f091c28643eb
SHA256

a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee
SHA512

6255adf8fbf7617a01ffa272426927653be65cfcc2353da5f3021b877c57bd58855cc353dd7aad731a18b5542135079b0b19b284b8644be4fa574825cb4de754

Score

10^/10

njrat evasion trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

3856 netsh.exe

pid	process
3856	netsh.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe

description	pid	process
Token: SeDebugPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: 33	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
Token: SeIncBasePriorityPrivilege	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe

description	pid	process	target process
PID 5000 wrote to memory of 3856	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe	netsh.exe
PID 5000 wrote to memory of 3856	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe	netsh.exe
PID 5000 wrote to memory of 3856	5000	a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe
"C:\Users\Admin\AppData\Local\Temp\a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe" "a9ac0c55b838d0f7cf2f489911a71dca70270970d21c5de2c9d871656644e6ee.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:3856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-134-0x0000000000000000-mapping.dmp

Download
memory/5000-132-0x0000000074980000-0x0000000074F31000-memory.dmp

Filesize
5.7MB

Download
memory/5000-133-0x0000000074980000-0x0000000074F31000-memory.dmp

Filesize
5.7MB

Download