njrat | f9dfaeff5fd22709b5cd29cb23c6f7c81f392f3a2d88c2bcf09fb4b599fb6f30

General

Target

Serveftgr.exe
Size

93KB
MD5

97266b25a791e68493ea2563306c7cf0
SHA1

d161fff47235e7d60209b6feae74019e6d000297
SHA256

f9dfaeff5fd22709b5cd29cb23c6f7c81f392f3a2d88c2bcf09fb4b599fb6f30
SHA512

9eac60682d5ce4398dfd45449fde4272cba942fa01afe7034ef0b1393605f7a65997a52c9ae960d87d973dab1c9c2f0dfa339ae921470664f241a71cc9d82d09

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

c3VzaWFoYXQyNDE5OWEuZGRucy5uZXQStrik:NTU1Mg==

Mutex

a8f08fa23dbc544d76787e679872404a

Attributes

reg_key
a8f08fa23dbc544d76787e679872404a
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

1648 server.exe
Modifies Windows Firewall 1 TTPs 3 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exe

pid process

1368 netsh.exe
676 netsh.exe
1820 netsh.exe

pid	process
1368	netsh.exe
676	netsh.exe
1820	netsh.exe

Drops startup file 6 IoCs

Processes:

server.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8f08fa23dbc544d76787e679872404aWindows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8f08fa23dbc544d76787e679872404aWindows Update.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe

Loads dropped DLL 2 IoCs

Processes:

Serveftgr.exe

pid process

1212 Serveftgr.exe
1212 Serveftgr.exe
Drops file in System32 directory 1 IoCs

Processes:

server.exe

description ioc process

File created C:\Windows\SysWOW64\Explorer.exe server.exe

pid	process
1212	Serveftgr.exe
1212	Serveftgr.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Explorer.exe	server.exe

Drops file in Program Files directory 2 IoCs

Processes:

server.exe

description	ioc	process
File created	C:\Program Files (x86)\Explorer.exe	server.exe
File opened for modification	C:\Program Files (x86)\Explorer.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

server.exe

pid	process
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe
1648	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

server.exe

pid process

1648 server.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	1648	server.exe
Token: 33	1648	server.exe
Token: SeIncBasePriorityPrivilege	1648	server.exe
Token: 33	1648	server.exe
Token: SeIncBasePriorityPrivilege	1648	server.exe
Token: 33	1648	server.exe
Token: SeIncBasePriorityPrivilege	1648	server.exe
Token: 33	1648	server.exe
Token: SeIncBasePriorityPrivilege	1648	server.exe
Token: 33	1648	server.exe
Token: SeIncBasePriorityPrivilege	1648	server.exe
Token: 33	1648	server.exe
Token: SeIncBasePriorityPrivilege	1648	server.exe
Token: 33	1648	server.exe
Token: SeIncBasePriorityPrivilege	1648	server.exe
Token: 33	1648	server.exe
Token: SeIncBasePriorityPrivilege	1648	server.exe
Token: 33	1648	server.exe
Token: SeIncBasePriorityPrivilege	1648	server.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Serveftgr.exeserver.exe

description	pid	process	target process
PID 1212 wrote to memory of 1648	1212	Serveftgr.exe	server.exe
PID 1212 wrote to memory of 1648	1212	Serveftgr.exe	server.exe
PID 1212 wrote to memory of 1648	1212	Serveftgr.exe	server.exe
PID 1212 wrote to memory of 1648	1212	Serveftgr.exe	server.exe
PID 1648 wrote to memory of 1368	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 1368	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 1368	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 1368	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 676	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 676	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 676	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 676	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 1820	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 1820	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 1820	1648	server.exe	netsh.exe
PID 1648 wrote to memory of 1820	1648	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Serveftgr.exe
"C:\Users\Admin\AppData\Local\Temp\Serveftgr.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1368

C:\Windows\SysWOW64\netsh.exe
netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
3⤵
- Modifies Windows Firewall
PID:676

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
93KB

MD5
97266b25a791e68493ea2563306c7cf0

SHA1
d161fff47235e7d60209b6feae74019e6d000297

SHA256
f9dfaeff5fd22709b5cd29cb23c6f7c81f392f3a2d88c2bcf09fb4b599fb6f30

SHA512
9eac60682d5ce4398dfd45449fde4272cba942fa01afe7034ef0b1393605f7a65997a52c9ae960d87d973dab1c9c2f0dfa339ae921470664f241a71cc9d82d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
93KB

MD5
97266b25a791e68493ea2563306c7cf0

SHA1
d161fff47235e7d60209b6feae74019e6d000297

SHA256
f9dfaeff5fd22709b5cd29cb23c6f7c81f392f3a2d88c2bcf09fb4b599fb6f30

SHA512
9eac60682d5ce4398dfd45449fde4272cba942fa01afe7034ef0b1393605f7a65997a52c9ae960d87d973dab1c9c2f0dfa339ae921470664f241a71cc9d82d09

Download Submit
C:\Users\Admin\AppData\Roaming\app
Filesize
4B

MD5
3eb8a6afa534fadc147aa70dea76e863

SHA1
03b827d99098f69c9f126679598f7166c99d1624

SHA256
d3d1d98df443947ab0b52378acbb5f5c21593677b45f0403b3831c93d8be7fca

SHA512
b9d20e1f18dd2dc9a71e436e5c27854196f1f8f0adfbf59aed9d70ab83b88c2c39958720508e87d98f8cb23dcb7bbaa81825406439edcc07b6d2ee310acd4327

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
93KB

MD5
97266b25a791e68493ea2563306c7cf0

SHA1
d161fff47235e7d60209b6feae74019e6d000297

SHA256
f9dfaeff5fd22709b5cd29cb23c6f7c81f392f3a2d88c2bcf09fb4b599fb6f30

SHA512
9eac60682d5ce4398dfd45449fde4272cba942fa01afe7034ef0b1393605f7a65997a52c9ae960d87d973dab1c9c2f0dfa339ae921470664f241a71cc9d82d09

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
93KB

MD5
97266b25a791e68493ea2563306c7cf0

SHA1
d161fff47235e7d60209b6feae74019e6d000297

SHA256
f9dfaeff5fd22709b5cd29cb23c6f7c81f392f3a2d88c2bcf09fb4b599fb6f30

SHA512
9eac60682d5ce4398dfd45449fde4272cba942fa01afe7034ef0b1393605f7a65997a52c9ae960d87d973dab1c9c2f0dfa339ae921470664f241a71cc9d82d09

Download Submit
memory/676-67-0x0000000000000000-mapping.dmp

Download
memory/1212-55-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/1212-62-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/1212-54-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download
memory/1368-65-0x0000000000000000-mapping.dmp

Download
memory/1648-64-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/1648-58-0x0000000000000000-mapping.dmp

Download
memory/1648-71-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/1648-72-0x0000000001E65000-0x0000000001E76000-memory.dmp

Filesize
68KB

Download
memory/1648-73-0x0000000001E65000-0x0000000001E76000-memory.dmp

Filesize
68KB

Download
memory/1820-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads