njrat | hxxp://20[.]7[.]14[.]99/server/

General

Target

http://20.7.14.99/server/

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

20.7.14.99:5552

Mutex

9636f5e673cfb8069e1ef3d1f8bc784b

Attributes

reg_key
9636f5e673cfb8069e1ef3d1f8bc784b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Server.exeserver.exe

pid process

1940 Server.exe
1744 server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1736 netsh.exe

pid	process
1940	Server.exe
1744	server.exe

pid	process
1736	netsh.exe

Drops startup file 2 IoCs

Processes:

server.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9636f5e673cfb8069e1ef3d1f8bc784b.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9636f5e673cfb8069e1ef3d1f8bc784b.exe	server.exe

Loads dropped DLL 1 IoCs

Processes:

Server.exe

pid process

1940 Server.exe

pid	process
1940	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9636f5e673cfb8069e1ef3d1f8bc784b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\9636f5e673cfb8069e1ef3d1f8bc784b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = b05e195414bdd801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "368699742"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DA022F1-2907-11ED-B25A-FE72C9E2D9C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000008290e667716bf4be8732c1d1d1b0a802fee6cc170389f507d66bc311b4c2b7d8000000000e800000000200002000000021a47216160efd424ca1a1c2f0b6cd3b743012677cbbe15bc878cacc8ef1c18220000000aec039914fc2e85107306d50b5f25e4c06e0aec47e85f82eea29f234b18a8ddb400000006784d7b0296eaed961ce0f7f5945855e1810645ddb3dc089f73880a5c379959a76f554bb89650daa1ff84aa4427103a3c39f379d5347f3e3598f734e1ee5e4cb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000000ee33d85869704db3365efd4ac0d65b9826e189d0db6812594fcb4dc918f709b000000000e80000000020000200000003e1e783b4ae4dcc8012268e64e89140443a4f660ebf63b7f63990fec5b67f08a90000000cd077ac5edb672ab95c6c2590abe70a281a786b258e3497f5fb101ec6b4c563db8b98801855cd18cf23a7b1f9bf9fdb1857ecb421eebe1c1fc11fa3db378692132c466a0cd623aad20a18635a5dd349c97f558dead79196bc8d6e075e3deba9bb8d4c8131f733f5eb2c39b74ae8f159fb1f785a465798573a80b13f054d3e395ab86a3d3e5512b29df80e859715ec402400000002fb2b16c2223fcfecfac01db0a1ace91d2b969ab8f137d41b96789d350d5960586a6215bdd4d3f0ead602b7f9576ce3bdd38519a183604a52271ff4f5ce232ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4062be5714bdd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	1744	server.exe
Token: 33	1744	server.exe
Token: SeIncBasePriorityPrivilege	1744	server.exe
Token: 33	1744	server.exe
Token: SeIncBasePriorityPrivilege	1744	server.exe
Token: 33	1744	server.exe
Token: SeIncBasePriorityPrivilege	1744	server.exe
Token: 33	1744	server.exe
Token: SeIncBasePriorityPrivilege	1744	server.exe
Token: 33	1744	server.exe
Token: SeIncBasePriorityPrivilege	1744	server.exe
Token: 33	1744	server.exe
Token: SeIncBasePriorityPrivilege	1744	server.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1668 iexplore.exe
1668 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1668 iexplore.exe
1668 iexplore.exe
1224 IEXPLORE.EXE
1224 IEXPLORE.EXE
1224 IEXPLORE.EXE
1224 IEXPLORE.EXE
1224 IEXPLORE.EXE
1224 IEXPLORE.EXE

pid	process
1668	iexplore.exe
1668	iexplore.exe

pid	process
1668	iexplore.exe
1668	iexplore.exe
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

iexplore.exeServer.exeserver.exe

description	pid	process	target process
PID 1668 wrote to memory of 1224	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 1224	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 1224	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 1224	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 1940	1668	iexplore.exe	Server.exe
PID 1668 wrote to memory of 1940	1668	iexplore.exe	Server.exe
PID 1668 wrote to memory of 1940	1668	iexplore.exe	Server.exe
PID 1668 wrote to memory of 1940	1668	iexplore.exe	Server.exe
PID 1940 wrote to memory of 1744	1940	Server.exe	server.exe
PID 1940 wrote to memory of 1744	1940	Server.exe	server.exe
PID 1940 wrote to memory of 1744	1940	Server.exe	server.exe
PID 1940 wrote to memory of 1744	1940	Server.exe	server.exe
PID 1744 wrote to memory of 1736	1744	server.exe	netsh.exe
PID 1744 wrote to memory of 1736	1744	server.exe	netsh.exe
PID 1744 wrote to memory of 1736	1744	server.exe	netsh.exe
PID 1744 wrote to memory of 1736	1744	server.exe	netsh.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://20.7.14.99/server/
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1224

C:\Users\Admin\Downloads\Server.exe
"C:\Users\Admin\Downloads\Server.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:1736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat
Filesize
34KB

MD5
e59d05e3ab436d138aa477af9fcac136

SHA1
ac2c829b6954e7b74c7cb6e9774592a7a5ff3070

SHA256
775e989ea0fd2ad0881f1bae7ea17a8fc88069775eb7e7d00ca1c356c41aec77

SHA512
ac3ea11d7b08916638084a23b7a564b6934f4c87cce5eddcbaa425adea25798aaebdb4dc262bef1632296312f693a54067e0fd294f469edd57e1b5265173798d

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
23KB

MD5
4cc52b12b15e02c96fed275defa813af

SHA1
a35a727745e25e1b71119968d3f090dfc4c07c18

SHA256
db62cd044da6120e08c11b7cc41f9ac0fb160adedd1f7a3a6380713d3a305357

SHA512
addaa15db05d0eee7f43715406fc41ebd1dd0dc1b626d473c85c302ff541f7033dd77585912e1630e10474db212aa5d9122bb8527d9383437fba9d56e90c3676

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
23KB

MD5
4cc52b12b15e02c96fed275defa813af

SHA1
a35a727745e25e1b71119968d3f090dfc4c07c18

SHA256
db62cd044da6120e08c11b7cc41f9ac0fb160adedd1f7a3a6380713d3a305357

SHA512
addaa15db05d0eee7f43715406fc41ebd1dd0dc1b626d473c85c302ff541f7033dd77585912e1630e10474db212aa5d9122bb8527d9383437fba9d56e90c3676

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PPOS0VTN.txt
Filesize
608B

MD5
d6e4cae8d2e78d449fda6012964eb774

SHA1
ddfb5964841e5a2a50ec91f2e0babdc69de8c425

SHA256
8c3461ac3a1cfe7ca67cc16d42bc05946a577b18414748081ee1a5bb22dd7c7d

SHA512
11b4ebe28519fc92556f087516097b4494f5c16d280b5c80d9617b703e6fe1ba04cad17a6ebb319a31c5d2f18c48c28468b0c8d1befcabc0f7e2a13c8a80b474

Download Submit
C:\Users\Admin\Downloads\Server.exe
Filesize
23KB

MD5
4cc52b12b15e02c96fed275defa813af

SHA1
a35a727745e25e1b71119968d3f090dfc4c07c18

SHA256
db62cd044da6120e08c11b7cc41f9ac0fb160adedd1f7a3a6380713d3a305357

SHA512
addaa15db05d0eee7f43715406fc41ebd1dd0dc1b626d473c85c302ff541f7033dd77585912e1630e10474db212aa5d9122bb8527d9383437fba9d56e90c3676

Download Submit
C:\Users\Admin\Downloads\Server.exe.y0ibym7.partial
Filesize
23KB

MD5
4cc52b12b15e02c96fed275defa813af

SHA1
a35a727745e25e1b71119968d3f090dfc4c07c18

SHA256
db62cd044da6120e08c11b7cc41f9ac0fb160adedd1f7a3a6380713d3a305357

SHA512
addaa15db05d0eee7f43715406fc41ebd1dd0dc1b626d473c85c302ff541f7033dd77585912e1630e10474db212aa5d9122bb8527d9383437fba9d56e90c3676

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
23KB

MD5
4cc52b12b15e02c96fed275defa813af

SHA1
a35a727745e25e1b71119968d3f090dfc4c07c18

SHA256
db62cd044da6120e08c11b7cc41f9ac0fb160adedd1f7a3a6380713d3a305357

SHA512
addaa15db05d0eee7f43715406fc41ebd1dd0dc1b626d473c85c302ff541f7033dd77585912e1630e10474db212aa5d9122bb8527d9383437fba9d56e90c3676

Download Submit
memory/1736-67-0x0000000000000000-mapping.dmp

Download
memory/1744-61-0x0000000000000000-mapping.dmp

Download
memory/1744-66-0x0000000070CC0000-0x000000007126B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-70-0x0000000070CC0000-0x000000007126B000-memory.dmp

Filesize
5.7MB

Download
memory/1940-59-0x0000000070CC0000-0x000000007126B000-memory.dmp

Filesize
5.7MB

Download
memory/1940-58-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1940-65-0x0000000070CC0000-0x000000007126B000-memory.dmp

Filesize
5.7MB

Download
memory/1940-56-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads