njrat | ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac

General

Target

animalhaha.exe
Size

27KB
MD5

f24251c4a9bc8f5613026d85ac28dbab
SHA1

9eb4b74cee39a1f44241b449fc872710f884924f
SHA256

ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac
SHA512

b5a1e69fff362cd2863c38b914a3145948aeb33838d3a419ac9f26abf269ac26023541a28c9e2038b94248467cec82063e078d27109d0600fdc29b2c695d32ca

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

194.5.98.188:4003

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

PowerPoint 2016.exe

pid process

1624 PowerPoint 2016.exe

pid	process
1624	PowerPoint 2016.exe

Drops startup file 5 IoCs

Processes:

attrib.exeanimalhaha.exePowerPoint 2016.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	animalhaha.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	PowerPoint 2016.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	PowerPoint 2016.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	PowerPoint 2016.exe

Loads dropped DLL 1 IoCs

Processes:

animalhaha.exe

pid process

2000 animalhaha.exe

pid	process
2000	animalhaha.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

animalhaha.exePowerPoint 2016.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\PowerPoint 2016.exe"	animalhaha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	PowerPoint 2016.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	PowerPoint 2016.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	PowerPoint 2016.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	PowerPoint 2016.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

PowerPoint 2016.exe

description	pid	process
Token: SeDebugPrivilege	1624	PowerPoint 2016.exe
Token: 33	1624	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	1624	PowerPoint 2016.exe
Token: 33	1624	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	1624	PowerPoint 2016.exe
Token: 33	1624	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	1624	PowerPoint 2016.exe
Token: 33	1624	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	1624	PowerPoint 2016.exe
Token: 33	1624	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	1624	PowerPoint 2016.exe
Token: 33	1624	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	1624	PowerPoint 2016.exe
Token: 33	1624	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	1624	PowerPoint 2016.exe
Token: 33	1624	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	1624	PowerPoint 2016.exe
Token: 33	1624	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	1624	PowerPoint 2016.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

animalhaha.exePowerPoint 2016.exe

description	pid	process	target process
PID 2000 wrote to memory of 1624	2000	animalhaha.exe	PowerPoint 2016.exe
PID 2000 wrote to memory of 1624	2000	animalhaha.exe	PowerPoint 2016.exe
PID 2000 wrote to memory of 1624	2000	animalhaha.exe	PowerPoint 2016.exe
PID 2000 wrote to memory of 1624	2000	animalhaha.exe	PowerPoint 2016.exe
PID 2000 wrote to memory of 1396	2000	animalhaha.exe	attrib.exe
PID 2000 wrote to memory of 1396	2000	animalhaha.exe	attrib.exe
PID 2000 wrote to memory of 1396	2000	animalhaha.exe	attrib.exe
PID 2000 wrote to memory of 1396	2000	animalhaha.exe	attrib.exe
PID 1624 wrote to memory of 1716	1624	PowerPoint 2016.exe	attrib.exe
PID 1624 wrote to memory of 1716	1624	PowerPoint 2016.exe	attrib.exe
PID 1624 wrote to memory of 1716	1624	PowerPoint 2016.exe	attrib.exe
PID 1624 wrote to memory of 1716	1624	PowerPoint 2016.exe	attrib.exe
PID 1624 wrote to memory of 428	1624	PowerPoint 2016.exe	attrib.exe
PID 1624 wrote to memory of 428	1624	PowerPoint 2016.exe	attrib.exe
PID 1624 wrote to memory of 428	1624	PowerPoint 2016.exe	attrib.exe
PID 1624 wrote to memory of 428	1624	PowerPoint 2016.exe	attrib.exe

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exe

pid process

1396 attrib.exe
1716 attrib.exe
428 attrib.exe

pid	process
1396	attrib.exe
1716	attrib.exe
428	attrib.exe

C:\Users\Admin\AppData\Local\Temp\animalhaha.exe
"C:\Users\Admin\AppData\Local\Temp\animalhaha.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe
"C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
3⤵
- Drops startup file
- Views/modifies file attributes
PID:1716

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
3⤵
- Views/modifies file attributes
PID:428

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe"
2⤵
- Views/modifies file attributes
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe
Filesize
27KB

MD5
f24251c4a9bc8f5613026d85ac28dbab

SHA1
9eb4b74cee39a1f44241b449fc872710f884924f

SHA256
ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac

SHA512
b5a1e69fff362cd2863c38b914a3145948aeb33838d3a419ac9f26abf269ac26023541a28c9e2038b94248467cec82063e078d27109d0600fdc29b2c695d32ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
Filesize
1KB

MD5
6ef25b3eced762068903a3dd7b87d56c

SHA1
a03a3ebc3428b8d0237866ae884034dd5f3b4464

SHA256
b2276962b30133844df951f788988be2eda64fa29dd8df34222c0c07db714c0c

SHA512
bd60b46e08fa8bbbff31ea7b4835cfefbe9c4e25669b263c8bccac243f376045d128cc5500ecb0de988e2ed2ff2884099f6b7589b7128812496c318434bec1d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
Filesize
1022B

MD5
22a175d80d24c1d69756edb3d66485d1

SHA1
963e69344259b827ef50220f5d0e6eb5fb48c874

SHA256
93ec5e5903727794605a8db5715615d70a95e19bc1ab0e48504f0ff1ddabe887

SHA512
b4f5b0e55a1a16f41235fd541cb0fe313a15b116b049a7fcc78bf5b5af5610822427acfce3209533acb64fee4a0fbfca7b68d11e3d3372118a0a91d016235ea2

Download Submit
C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe
Filesize
27KB

MD5
f24251c4a9bc8f5613026d85ac28dbab

SHA1
9eb4b74cee39a1f44241b449fc872710f884924f

SHA256
ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac

SHA512
b5a1e69fff362cd2863c38b914a3145948aeb33838d3a419ac9f26abf269ac26023541a28c9e2038b94248467cec82063e078d27109d0600fdc29b2c695d32ca

Download Submit
C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe
Filesize
27KB

MD5
f24251c4a9bc8f5613026d85ac28dbab

SHA1
9eb4b74cee39a1f44241b449fc872710f884924f

SHA256
ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac

SHA512
b5a1e69fff362cd2863c38b914a3145948aeb33838d3a419ac9f26abf269ac26023541a28c9e2038b94248467cec82063e078d27109d0600fdc29b2c695d32ca

Download Submit
\Users\Admin\AppData\Roaming\PowerPoint 2016.exe
Filesize
27KB

MD5
f24251c4a9bc8f5613026d85ac28dbab

SHA1
9eb4b74cee39a1f44241b449fc872710f884924f

SHA256
ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac

SHA512
b5a1e69fff362cd2863c38b914a3145948aeb33838d3a419ac9f26abf269ac26023541a28c9e2038b94248467cec82063e078d27109d0600fdc29b2c695d32ca

Download Submit
memory/428-67-0x0000000000000000-mapping.dmp

Download
memory/1396-60-0x0000000000000000-mapping.dmp

Download
memory/1624-57-0x0000000000000000-mapping.dmp

Download
memory/1624-65-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/1624-69-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/1716-66-0x0000000000000000-mapping.dmp

Download
memory/2000-54-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/2000-64-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/2000-55-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads