njrat | 8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4

General

Target

47bea8a28b1e81e3342d594fc57acd8e.exe
Size

27KB
MD5

47bea8a28b1e81e3342d594fc57acd8e
SHA1

d301e8985e53b7baabf9b45df087a017e3817742
SHA256

8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4
SHA512

d5f2bfa425fa0c8d7fe2531b57ed9dbe5ca9b8bb8b7a868e39b251182446a22bcf01c3181d17b3362bc2a76b56cda1e504db2436fafbf922ee2120f76e8d00b6
SSDEEP

384:2LBH6uj/+AU9038hfOexuaP39hRnMYAQk93vmhm7UMKmIEecKdbXTzm9bVhcaL62:wBa0mkspJtyYA/vMHTi9bD

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

C2

216.250.251.104:2028

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Payload.exe

pid process

1936 Payload.exe

pid	process
1936	Payload.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

47bea8a28b1e81e3342d594fc57acd8e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	47bea8a28b1e81e3342d594fc57acd8e.exe

Drops startup file 2 IoCs

Processes:

47bea8a28b1e81e3342d594fc57acd8e.exePayload.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	47bea8a28b1e81e3342d594fc57acd8e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Payload.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

47bea8a28b1e81e3342d594fc57acd8e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Payload.exe"	47bea8a28b1e81e3342d594fc57acd8e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

Payload.exe

description	pid	process
Token: SeDebugPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe
Token: 33	1936	Payload.exe
Token: SeIncBasePriorityPrivilege	1936	Payload.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

47bea8a28b1e81e3342d594fc57acd8e.exe

description	pid	process	target process
PID 3172 wrote to memory of 1936	3172	47bea8a28b1e81e3342d594fc57acd8e.exe	Payload.exe
PID 3172 wrote to memory of 1936	3172	47bea8a28b1e81e3342d594fc57acd8e.exe	Payload.exe
PID 3172 wrote to memory of 1936	3172	47bea8a28b1e81e3342d594fc57acd8e.exe	Payload.exe
PID 3172 wrote to memory of 4036	3172	47bea8a28b1e81e3342d594fc57acd8e.exe	attrib.exe
PID 3172 wrote to memory of 4036	3172	47bea8a28b1e81e3342d594fc57acd8e.exe	attrib.exe
PID 3172 wrote to memory of 4036	3172	47bea8a28b1e81e3342d594fc57acd8e.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

4036 attrib.exe

pid	process
4036	attrib.exe

C:\Users\Admin\AppData\Local\Temp\47bea8a28b1e81e3342d594fc57acd8e.exe
"C:\Users\Admin\AppData\Local\Temp\47bea8a28b1e81e3342d594fc57acd8e.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3172

C:\Users\Admin\AppData\Roaming\Payload.exe
"C:\Users\Admin\AppData\Roaming\Payload.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Payload.exe"
2⤵
- Views/modifies file attributes
PID:4036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
Filesize
1KB

MD5
c87a0c01932e2b874bc3b392253a663a

SHA1
51422af62636aaaedfccbe8e4f49ffc027a90989

SHA256
8a2b0b8a4e2bd3a1d8bad6ccd1dd2b92561b9abb7156b6701a6190458507795c

SHA512
ffd135cebd6e00bb32e0fba5361554e617af27556022ab3cb04c43eae8121ebd17d3868bef382061d7cbc993e805e1501bd580bdcead8f77b44f8889ac14c0a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
Filesize
1KB

MD5
586210e5f1de944d08dd141fcadd408a

SHA1
0b539a283bfe6c23839a5c44f668af3ae205288d

SHA256
90a7d4cf6b4f075b45da710cf2f1fdfa71d0a654beb240fb74ff968ead06f742

SHA512
4a2ffa2d32f1bbcbfb1d0d76509717b9088ccb99557e47b03b03277524d4f1c6bc419dd91537ffd7e8fee7e427c017de3bec88c80c21c326388efe45c3dccca6

Download Submit
C:\Users\Admin\AppData\Roaming\Payload.exe
Filesize
27KB

MD5
47bea8a28b1e81e3342d594fc57acd8e

SHA1
d301e8985e53b7baabf9b45df087a017e3817742

SHA256
8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4

SHA512
d5f2bfa425fa0c8d7fe2531b57ed9dbe5ca9b8bb8b7a868e39b251182446a22bcf01c3181d17b3362bc2a76b56cda1e504db2436fafbf922ee2120f76e8d00b6

Download Submit
C:\Users\Admin\AppData\Roaming\Payload.exe
Filesize
27KB

MD5
47bea8a28b1e81e3342d594fc57acd8e

SHA1
d301e8985e53b7baabf9b45df087a017e3817742

SHA256
8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4

SHA512
d5f2bfa425fa0c8d7fe2531b57ed9dbe5ca9b8bb8b7a868e39b251182446a22bcf01c3181d17b3362bc2a76b56cda1e504db2436fafbf922ee2120f76e8d00b6

Download Submit
memory/1936-135-0x0000000000000000-mapping.dmp

Download
memory/1936-141-0x0000000006380000-0x0000000006412000-memory.dmp

Filesize
584KB

Download
memory/1936-142-0x0000000006350000-0x000000000635A000-memory.dmp

Filesize
40KB

Download
memory/1936-143-0x0000000006590000-0x00000000065F6000-memory.dmp

Filesize
408KB

Download
memory/3172-132-0x0000000000F80000-0x0000000000F8E000-memory.dmp

Filesize
56KB

Download
memory/3172-133-0x0000000005900000-0x000000000599C000-memory.dmp

Filesize
624KB

Download
memory/3172-134-0x0000000006760000-0x0000000006D04000-memory.dmp

Filesize
5.6MB

Download
memory/4036-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads