njrat | c9e8a120268308c6f2392fdb2fa65dee5f2cd48b8bb3433d5de9842ea1d987da

General

Target

a258fbc6346a5c5fcc28480a601d284c.exe
Size

27KB
MD5

a258fbc6346a5c5fcc28480a601d284c
SHA1

d579a1a2d1e79885ad80d4b3eb4d1a294f205399
SHA256

c9e8a120268308c6f2392fdb2fa65dee5f2cd48b8bb3433d5de9842ea1d987da
SHA512

7733d6836ceba7467d4925449297c69732e2ec5da9a6c93089deb2cecf2053726c6a91588a5255a71fbfd76bd8af89c74dab1a4ee19ee09ed6f88c3ff333582a
SSDEEP

384:2LuFFWP0CDZwnXmIQXkj90jEwmFterkSuldsP3NBa6Ml7AQk93vmhm7UMKmIEec1:wnRICol7A/vMHTi9bD

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

nomorelife15.ddns.net:9999

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Payload.exe

pid process

1712 Payload.exe

pid	process
1712	Payload.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a258fbc6346a5c5fcc28480a601d284c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a258fbc6346a5c5fcc28480a601d284c.exe

Drops startup file 4 IoCs

Processes:

a258fbc6346a5c5fcc28480a601d284c.exePayload.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	a258fbc6346a5c5fcc28480a601d284c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Payload.exea258fbc6346a5c5fcc28480a601d284c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Windows\\Payload.exe"	a258fbc6346a5c5fcc28480a601d284c.exe

Drops file in Windows directory 2 IoCs

Processes:

a258fbc6346a5c5fcc28480a601d284c.exeattrib.exe

description	ioc	process
File created	C:\Windows\Payload.exe	a258fbc6346a5c5fcc28480a601d284c.exe
File opened for modification	C:\Windows\Payload.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

Payload.exe

description	pid	process
Token: SeDebugPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe
Token: 33	1712	Payload.exe
Token: SeIncBasePriorityPrivilege	1712	Payload.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a258fbc6346a5c5fcc28480a601d284c.exe

description	pid	process	target process
PID 1912 wrote to memory of 1712	1912	a258fbc6346a5c5fcc28480a601d284c.exe	Payload.exe
PID 1912 wrote to memory of 1712	1912	a258fbc6346a5c5fcc28480a601d284c.exe	Payload.exe
PID 1912 wrote to memory of 1712	1912	a258fbc6346a5c5fcc28480a601d284c.exe	Payload.exe
PID 1912 wrote to memory of 4268	1912	a258fbc6346a5c5fcc28480a601d284c.exe	attrib.exe
PID 1912 wrote to memory of 4268	1912	a258fbc6346a5c5fcc28480a601d284c.exe	attrib.exe
PID 1912 wrote to memory of 4268	1912	a258fbc6346a5c5fcc28480a601d284c.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

4268 attrib.exe

pid	process
4268	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a258fbc6346a5c5fcc28480a601d284c.exe
"C:\Users\Admin\AppData\Local\Temp\a258fbc6346a5c5fcc28480a601d284c.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\Payload.exe
"C:\Windows\Payload.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Windows\Payload.exe"
2⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:4268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
Filesize
1KB

MD5
fc4ece01046898c8b9c7c4f4260152e1

SHA1
5347cf792057782a4893b89484914cdae81a2c41

SHA256
3f10c28e71e2cb6b608d505d64d8b1af0d1e9eed005298681dd954fbdca160cc

SHA512
b4c2aba8ea3a0ec7f14755ccec09a0d9114f90b896d9818d735f79fd897677d6b58c3ad19e58ace5b2828ff88c66df99f8092a97fc34ce09e0e223c3f050592d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
Filesize
1KB

MD5
bb2862a3539c6fedeeb022885334bef3

SHA1
f218360ab9e07ce2f4a01c96553a259d18a1086c

SHA256
702ba32902ff3b6abdaf43a5ee6b39f2ae343aa1f3147734f311a7be1497e4a9

SHA512
201de020ada87b2c223ebb0ea5426cff92e229c6dc31414db32d9f0e0a610301d5c4001e785380ec983e1cd9c7108daf2a59a7d129674814ca9d58b24a26479d

Download Submit
C:\Windows\Payload.exe
Filesize
27KB

MD5
a258fbc6346a5c5fcc28480a601d284c

SHA1
d579a1a2d1e79885ad80d4b3eb4d1a294f205399

SHA256
c9e8a120268308c6f2392fdb2fa65dee5f2cd48b8bb3433d5de9842ea1d987da

SHA512
7733d6836ceba7467d4925449297c69732e2ec5da9a6c93089deb2cecf2053726c6a91588a5255a71fbfd76bd8af89c74dab1a4ee19ee09ed6f88c3ff333582a

Download Submit
C:\Windows\Payload.exe
Filesize
27KB

MD5
a258fbc6346a5c5fcc28480a601d284c

SHA1
d579a1a2d1e79885ad80d4b3eb4d1a294f205399

SHA256
c9e8a120268308c6f2392fdb2fa65dee5f2cd48b8bb3433d5de9842ea1d987da

SHA512
7733d6836ceba7467d4925449297c69732e2ec5da9a6c93089deb2cecf2053726c6a91588a5255a71fbfd76bd8af89c74dab1a4ee19ee09ed6f88c3ff333582a

Download Submit
memory/1712-133-0x0000000000000000-mapping.dmp

Download
memory/1712-140-0x00000000747D0000-0x0000000074D81000-memory.dmp

Filesize
5.7MB

Download
memory/1712-141-0x00000000747D0000-0x0000000074D81000-memory.dmp

Filesize
5.7MB

Download
memory/1912-132-0x00000000747D0000-0x0000000074D81000-memory.dmp

Filesize
5.7MB

Download
memory/1912-138-0x00000000747D0000-0x0000000074D81000-memory.dmp

Filesize
5.7MB

Download
memory/4268-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads