njrat | ea1b0187bbd1a48bd632fddc7e2b367148e13827901cc06e10999a9b3baec8ef

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-08-2022 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe
Size

48KB
MD5

3d0c9b1cbd007a79d0df93c6249a24bc
SHA1

940e4787edaae8f71b10ae5574aa0267ec192341
SHA256

ea1b0187bbd1a48bd632fddc7e2b367148e13827901cc06e10999a9b3baec8ef
SHA512

4a9b6923ee468b45f05df607aa09f961ed262f3b4a5be5116d1335781c957edaecaf94513acc726b904241dc75b4ceb0a72d646f13674d4fa2da97d61664d2b3

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

easralahtane.ddns.net:3973

Mutex

de691f5a23326e1eca32cf33144b3175

Attributes

reg_key
de691f5a23326e1eca32cf33144b3175
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

taskhost .exe

pid process

1744 taskhost .exe
Loads dropped DLL 1 IoCs

Processes:

1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe

pid process

1648 1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1744	taskhost .exe

pid	process
1648	1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe

description	pid	process	target process
PID 1648 wrote to memory of 1744	1648	1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe	taskhost .exe
PID 1648 wrote to memory of 1744	1648	1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe	taskhost .exe
PID 1648 wrote to memory of 1744	1648	1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe	taskhost .exe
PID 1648 wrote to memory of 1744	1648	1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe	taskhost .exe

C:\Users\Admin\AppData\Local\Temp\1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1452-57-0x00000000009B0000-0x00000000009BC000-memory.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Roaming\taskhost .exe
"C:\Users\Admin\AppData\Roaming\taskhost .exe"
2⤵
- Executes dropped EXE
PID:1744

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\taskhost .exe
Filesize
48KB

MD5
3d0c9b1cbd007a79d0df93c6249a24bc

SHA1
940e4787edaae8f71b10ae5574aa0267ec192341

SHA256
ea1b0187bbd1a48bd632fddc7e2b367148e13827901cc06e10999a9b3baec8ef

SHA512
4a9b6923ee468b45f05df607aa09f961ed262f3b4a5be5116d1335781c957edaecaf94513acc726b904241dc75b4ceb0a72d646f13674d4fa2da97d61664d2b3

Download Submit
C:\Users\Admin\AppData\Roaming\taskhost .exe
Filesize
48KB

MD5
3d0c9b1cbd007a79d0df93c6249a24bc

SHA1
940e4787edaae8f71b10ae5574aa0267ec192341

SHA256
ea1b0187bbd1a48bd632fddc7e2b367148e13827901cc06e10999a9b3baec8ef

SHA512
4a9b6923ee468b45f05df607aa09f961ed262f3b4a5be5116d1335781c957edaecaf94513acc726b904241dc75b4ceb0a72d646f13674d4fa2da97d61664d2b3

Download Submit
\Users\Admin\AppData\Roaming\taskhost .exe
Filesize
48KB

MD5
3d0c9b1cbd007a79d0df93c6249a24bc

SHA1
940e4787edaae8f71b10ae5574aa0267ec192341

SHA256
ea1b0187bbd1a48bd632fddc7e2b367148e13827901cc06e10999a9b3baec8ef

SHA512
4a9b6923ee468b45f05df607aa09f961ed262f3b4a5be5116d1335781c957edaecaf94513acc726b904241dc75b4ceb0a72d646f13674d4fa2da97d61664d2b3

Download Submit
memory/1648-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1648-55-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1648-61-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1744-57-0x0000000000000000-mapping.dmp

Download
memory/1744-62-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download