njrat | d867671babf45616c23413f2a5d29fbe4d1e3589ce9478401f079f7ea87a60b8

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-08-2022 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0773d50f38708b79d24505a5313c575.exe
Size

43KB
MD5

a0773d50f38708b79d24505a5313c575
SHA1

2ac3d329285f806a2f825643a54a5e49edc15942
SHA256

d867671babf45616c23413f2a5d29fbe4d1e3589ce9478401f079f7ea87a60b8
SHA512

baf14ca0b95e598c07821f470c5d03dd62ea5bdfa2b588767013ccecf8bf8eada89850985a9a1e5d0f2e2e9675c98a916a944bc4d544917121492b5b04aa8282
SSDEEP

384:LZybN5ctOnwtOyW6n5yciAEm3VOEE8472IBzgIij+ZsNO3PlpJKkkjh/TzF7pWn2:l6qAwt/W65yciAEmFOg479uXQ/op3+L

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

5488.hopto.org:1604

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

Processes:

a0773d50f38708b79d24505a5313c575.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	a0773d50f38708b79d24505a5313c575.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	a0773d50f38708b79d24505a5313c575.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a0773d50f38708b79d24505a5313c575.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a0773d50f38708b79d24505a5313c575.exe\" .."	a0773d50f38708b79d24505a5313c575.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a0773d50f38708b79d24505a5313c575.exe\" .."	a0773d50f38708b79d24505a5313c575.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

a0773d50f38708b79d24505a5313c575.exe

pid process

1736 a0773d50f38708b79d24505a5313c575.exe

pid	process
1736	a0773d50f38708b79d24505a5313c575.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

a0773d50f38708b79d24505a5313c575.exe

description	pid	process
Token: SeDebugPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe
Token: 33	1736	a0773d50f38708b79d24505a5313c575.exe
Token: SeIncBasePriorityPrivilege	1736	a0773d50f38708b79d24505a5313c575.exe

C:\Users\Admin\AppData\Local\Temp\a0773d50f38708b79d24505a5313c575.exe
"C:\Users\Admin\AppData\Local\Temp\a0773d50f38708b79d24505a5313c575.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-54-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/1736-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download