njrat | ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac

General

Target

animalhaha.exe
Size

27KB
MD5

f24251c4a9bc8f5613026d85ac28dbab
SHA1

9eb4b74cee39a1f44241b449fc872710f884924f
SHA256

ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac
SHA512

b5a1e69fff362cd2863c38b914a3145948aeb33838d3a419ac9f26abf269ac26023541a28c9e2038b94248467cec82063e078d27109d0600fdc29b2c695d32ca

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

194.5.98.188:4003

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

PowerPoint 2016.exe

pid process

4456 PowerPoint 2016.exe

pid	process
4456	PowerPoint 2016.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

animalhaha.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	animalhaha.exe

Drops startup file 5 IoCs

Processes:

PowerPoint 2016.exeattrib.exeanimalhaha.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	PowerPoint 2016.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	animalhaha.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	PowerPoint 2016.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	PowerPoint 2016.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PowerPoint 2016.exeanimalhaha.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	PowerPoint 2016.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	PowerPoint 2016.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\PowerPoint 2016.exe"	animalhaha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	PowerPoint 2016.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	PowerPoint 2016.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

PowerPoint 2016.exe

description	pid	process
Token: SeDebugPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe
Token: 33	4456	PowerPoint 2016.exe
Token: SeIncBasePriorityPrivilege	4456	PowerPoint 2016.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

animalhaha.exePowerPoint 2016.exe

description	pid	process	target process
PID 4232 wrote to memory of 4456	4232	animalhaha.exe	PowerPoint 2016.exe
PID 4232 wrote to memory of 4456	4232	animalhaha.exe	PowerPoint 2016.exe
PID 4232 wrote to memory of 4456	4232	animalhaha.exe	PowerPoint 2016.exe
PID 4232 wrote to memory of 2828	4232	animalhaha.exe	attrib.exe
PID 4232 wrote to memory of 2828	4232	animalhaha.exe	attrib.exe
PID 4232 wrote to memory of 2828	4232	animalhaha.exe	attrib.exe
PID 4456 wrote to memory of 2084	4456	PowerPoint 2016.exe	attrib.exe
PID 4456 wrote to memory of 2084	4456	PowerPoint 2016.exe	attrib.exe
PID 4456 wrote to memory of 2084	4456	PowerPoint 2016.exe	attrib.exe
PID 4456 wrote to memory of 1424	4456	PowerPoint 2016.exe	attrib.exe
PID 4456 wrote to memory of 1424	4456	PowerPoint 2016.exe	attrib.exe
PID 4456 wrote to memory of 1424	4456	PowerPoint 2016.exe	attrib.exe

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exe

pid process

2828 attrib.exe
2084 attrib.exe
1424 attrib.exe

pid	process
2828	attrib.exe
2084	attrib.exe
1424	attrib.exe

C:\Users\Admin\AppData\Local\Temp\animalhaha.exe
"C:\Users\Admin\AppData\Local\Temp\animalhaha.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4232

C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe
"C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
3⤵
- Drops startup file
- Views/modifies file attributes
PID:2084

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
3⤵
- Views/modifies file attributes
PID:1424

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe"
2⤵
- Views/modifies file attributes
PID:2828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe
Filesize
27KB

MD5
f24251c4a9bc8f5613026d85ac28dbab

SHA1
9eb4b74cee39a1f44241b449fc872710f884924f

SHA256
ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac

SHA512
b5a1e69fff362cd2863c38b914a3145948aeb33838d3a419ac9f26abf269ac26023541a28c9e2038b94248467cec82063e078d27109d0600fdc29b2c695d32ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
Filesize
1KB

MD5
a31d3e4808ef53881583209e24cca184

SHA1
f7bd7c4d112891b54033d5088d4c575c0ce5830c

SHA256
44a46e517182173a9f2eb3826a0941cf37b6b3ff8dd99357143a3607a86b6cf4

SHA512
bfb20f18e22dfc61838eecde302035e0c3a6c79519500dcff97a9266eecd8b6b9e751497c21f5868613b8adf35fb2225e0ecf26cd89f34809bf4fd8d551771bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
Filesize
1KB

MD5
02710adc13af409ee40445149914fff1

SHA1
c2adac1d0987b021aef7fb052ebd3c5f31af5293

SHA256
658fba2dfed3510880bb7008f80ec04b61d4a5ce080649586d236b171380b13c

SHA512
57887f8dbb35609d6e8f5a0c9f6f4c3c067eb110a77bc26cb34b9ea6813db278074c1bc67039dc53b9b4b84f202f94484d2599df7039094951573b9e9d0f07b5

Download Submit
C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe
Filesize
27KB

MD5
f24251c4a9bc8f5613026d85ac28dbab

SHA1
9eb4b74cee39a1f44241b449fc872710f884924f

SHA256
ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac

SHA512
b5a1e69fff362cd2863c38b914a3145948aeb33838d3a419ac9f26abf269ac26023541a28c9e2038b94248467cec82063e078d27109d0600fdc29b2c695d32ca

Download Submit
C:\Users\Admin\AppData\Roaming\PowerPoint 2016.exe
Filesize
27KB

MD5
f24251c4a9bc8f5613026d85ac28dbab

SHA1
9eb4b74cee39a1f44241b449fc872710f884924f

SHA256
ba75eac69192e61b4479bc36eac36b4f127298f6b4763a7f4ade06f085c980ac

SHA512
b5a1e69fff362cd2863c38b914a3145948aeb33838d3a419ac9f26abf269ac26023541a28c9e2038b94248467cec82063e078d27109d0600fdc29b2c695d32ca

Download Submit
memory/1424-141-0x0000000000000000-mapping.dmp

Download
memory/2084-140-0x0000000000000000-mapping.dmp

Download
memory/2828-135-0x0000000000000000-mapping.dmp

Download
memory/4232-138-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4232-130-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4232-131-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4456-136-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4456-132-0x0000000000000000-mapping.dmp

Download
memory/4456-143-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads