njrat | 59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

General

Target

5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe
Size

25KB
MD5

5604f7e7a7ec0b2a91c80bac6e4ce7e3
SHA1

de20822d458b1fdd421260e5e42ce4888b6315c1
SHA256

59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c
SHA512

830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e
SSDEEP

384:sv3ZIgUhKIQ27JJGYtSfcGUxIpRGOmBeqEiVcp0F9h2HbmdPvo8I6CQAbqLKkVLl:svpkhJ7tCgcRG1kpwgwvj1CNqXV6U6m

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

7.tcp.eu.ngrok.io:13225

Mutex

WindowsEnginee

Attributes

reg_key
WindowsEnginee
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

dllhost.exeServer.exeServer.exe

pid process

956 dllhost.exe
608 Server.exe
1996 Server.exe

pid	process
956	dllhost.exe
608	Server.exe
1996	Server.exe

Drops startup file 2 IoCs

Processes:

dllhost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEnginee.exe	dllhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEnginee.exe	dllhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsEnginee = "\"C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe\" .."	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsEnginee = "\"C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe\" .."	dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2020 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dllhost.exe

pid process

956 dllhost.exe

pid	process
2020	schtasks.exe

pid	process
956	dllhost.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

dllhost.exe

description	pid	process
Token: SeDebugPrivilege	956	dllhost.exe
Token: 33	956	dllhost.exe
Token: SeIncBasePriorityPrivilege	956	dllhost.exe
Token: 33	956	dllhost.exe
Token: SeIncBasePriorityPrivilege	956	dllhost.exe
Token: 33	956	dllhost.exe
Token: SeIncBasePriorityPrivilege	956	dllhost.exe
Token: 33	956	dllhost.exe
Token: SeIncBasePriorityPrivilege	956	dllhost.exe
Token: 33	956	dllhost.exe
Token: SeIncBasePriorityPrivilege	956	dllhost.exe
Token: 33	956	dllhost.exe
Token: SeIncBasePriorityPrivilege	956	dllhost.exe
Token: 33	956	dllhost.exe
Token: SeIncBasePriorityPrivilege	956	dllhost.exe
Token: 33	956	dllhost.exe
Token: SeIncBasePriorityPrivilege	956	dllhost.exe
Token: 33	956	dllhost.exe
Token: SeIncBasePriorityPrivilege	956	dllhost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5604f7e7a7ec0b2a91c80bac6e4ce7e3.exedllhost.exetaskeng.exe

description	pid	process	target process
PID 1836 wrote to memory of 956	1836	5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe	dllhost.exe
PID 1836 wrote to memory of 956	1836	5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe	dllhost.exe
PID 1836 wrote to memory of 956	1836	5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe	dllhost.exe
PID 956 wrote to memory of 2020	956	dllhost.exe	schtasks.exe
PID 956 wrote to memory of 2020	956	dllhost.exe	schtasks.exe
PID 956 wrote to memory of 2020	956	dllhost.exe	schtasks.exe
PID 836 wrote to memory of 608	836	taskeng.exe	Server.exe
PID 836 wrote to memory of 608	836	taskeng.exe	Server.exe
PID 836 wrote to memory of 608	836	taskeng.exe	Server.exe
PID 836 wrote to memory of 1996	836	taskeng.exe	Server.exe
PID 836 wrote to memory of 1996	836	taskeng.exe	Server.exe
PID 836 wrote to memory of 1996	836	taskeng.exe	Server.exe

C:\Users\Admin\AppData\Local\Temp\5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe
"C:\Users\Admin\AppData\Local\Temp\5604f7e7a7ec0b2a91c80bac6e4ce7e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Roaming\dllhost.exe
"C:\Users\Admin\AppData\Roaming\dllhost.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\system32\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
3⤵
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\taskeng.exe
taskeng.exe {925C6A4D-0ABF-4F4F-8124-95AC6E7A5298} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:608

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
C:\Users\Admin\AppData\Roaming\dllhost.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
C:\Users\Admin\AppData\Roaming\dllhost.exe
Filesize
25KB

MD5
5604f7e7a7ec0b2a91c80bac6e4ce7e3

SHA1
de20822d458b1fdd421260e5e42ce4888b6315c1

SHA256
59e02dea77ea89b913bb8552b5c34009f7b84a04a4c61524c42ee3edccf06e3c

SHA512
830b1764256bdfd255c7fcfa90bd278a7790e295416ed972bcb71014ed688b8cc5466e5dc223c32984d40a5dee755b2f305d0c726ce80514e8e73e919e441e8e

Download Submit
memory/608-62-0x0000000000000000-mapping.dmp

Download
memory/608-65-0x00000000009B0000-0x00000000009B8000-memory.dmp

Filesize
32KB

Download
memory/956-60-0x00000000010D0000-0x00000000010D8000-memory.dmp

Filesize
32KB

Download
memory/956-57-0x0000000000000000-mapping.dmp

Download
memory/1836-54-0x0000000000B60000-0x0000000000B68000-memory.dmp

Filesize
32KB

Download
memory/1836-56-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/1836-55-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1996-66-0x0000000000000000-mapping.dmp

Download
memory/1996-68-0x00000000002C0000-0x00000000002C8000-memory.dmp

Filesize
32KB

Download
memory/2020-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads