njrat | 3e4960b191ea98d8960024a200e6bb7b2d85b3adcba93b0a93bb127ebbc5a06a

General

Target

1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe
Size

56KB
MD5

0e5e5f527c0ef084e3e381445f37056f
SHA1

1aa6ae381ae100bccc9de5ef875ca603c128aa48
SHA256

3e4960b191ea98d8960024a200e6bb7b2d85b3adcba93b0a93bb127ebbc5a06a
SHA512

b19748b3606270427cd97320cfd7bf026b8c7cfd10134f156405f25a0bb78f2b3b41efefd65c42a64faf1a9490705c2b6f34953b0818607e5861cba80dde1596

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

easralahtane.ddns.net:1177

Mutex

78c3f41e66e57697cb0f063c5b808ae6

Attributes

reg_key
78c3f41e66e57697cb0f063c5b808ae6
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

CCleaner.exe

pid process

968 CCleaner.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2044 netsh.exe
Loads dropped DLL 1 IoCs

Processes:

1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe

pid process

944 1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe

pid	process
2044	netsh.exe

pid	process
944	1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

CCleaner.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\78c3f41e66e57697cb0f063c5b808ae6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CCleaner.exe\" .."	CCleaner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\78c3f41e66e57697cb0f063c5b808ae6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CCleaner.exe\" .."	CCleaner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

CCleaner.exe

pid	process
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe
968	CCleaner.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CCleaner.exe

description pid process

Token: SeDebugPrivilege 968 CCleaner.exe

description	pid	process
Token: SeDebugPrivilege	968	CCleaner.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exeCCleaner.exe

description	pid	process	target process
PID 944 wrote to memory of 968	944	1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe	CCleaner.exe
PID 944 wrote to memory of 968	944	1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe	CCleaner.exe
PID 944 wrote to memory of 968	944	1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe	CCleaner.exe
PID 944 wrote to memory of 968	944	1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe	CCleaner.exe
PID 968 wrote to memory of 2044	968	CCleaner.exe	netsh.exe
PID 968 wrote to memory of 2044	968	CCleaner.exe	netsh.exe
PID 968 wrote to memory of 2044	968	CCleaner.exe	netsh.exe
PID 968 wrote to memory of 2044	968	CCleaner.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1432-57-0x0000000001D80000-0x0000000001D8E000-memory.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\CCleaner.exe
"C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\CCleaner.exe" "CCleaner.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CCleaner.exe
Filesize
56KB

MD5
0e5e5f527c0ef084e3e381445f37056f

SHA1
1aa6ae381ae100bccc9de5ef875ca603c128aa48

SHA256
3e4960b191ea98d8960024a200e6bb7b2d85b3adcba93b0a93bb127ebbc5a06a

SHA512
b19748b3606270427cd97320cfd7bf026b8c7cfd10134f156405f25a0bb78f2b3b41efefd65c42a64faf1a9490705c2b6f34953b0818607e5861cba80dde1596

Download Submit
C:\Users\Admin\AppData\Local\Temp\CCleaner.exe
Filesize
56KB

MD5
0e5e5f527c0ef084e3e381445f37056f

SHA1
1aa6ae381ae100bccc9de5ef875ca603c128aa48

SHA256
3e4960b191ea98d8960024a200e6bb7b2d85b3adcba93b0a93bb127ebbc5a06a

SHA512
b19748b3606270427cd97320cfd7bf026b8c7cfd10134f156405f25a0bb78f2b3b41efefd65c42a64faf1a9490705c2b6f34953b0818607e5861cba80dde1596

Download Submit
\Users\Admin\AppData\Local\Temp\CCleaner.exe
Filesize
56KB

MD5
0e5e5f527c0ef084e3e381445f37056f

SHA1
1aa6ae381ae100bccc9de5ef875ca603c128aa48

SHA256
3e4960b191ea98d8960024a200e6bb7b2d85b3adcba93b0a93bb127ebbc5a06a

SHA512
b19748b3606270427cd97320cfd7bf026b8c7cfd10134f156405f25a0bb78f2b3b41efefd65c42a64faf1a9490705c2b6f34953b0818607e5861cba80dde1596

Download Submit
memory/944-54-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/944-61-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/968-56-0x0000000000000000-mapping.dmp

Download
memory/968-62-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/968-64-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/2044-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads