njrat | a412582126a26088567044df41ee0d6e749bd7d7a0cbc375fc7628c7424ffe23

General

Target

8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe
Size

27KB
MD5

47bea8a28b1e81e3342d594fc57acd8e
SHA1

d301e8985e53b7baabf9b45df087a017e3817742
SHA256

8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4
SHA512

d5f2bfa425fa0c8d7fe2531b57ed9dbe5ca9b8bb8b7a868e39b251182446a22bcf01c3181d17b3362bc2a76b56cda1e504db2436fafbf922ee2120f76e8d00b6
SSDEEP

384:2LBH6uj/+AU9038hfOexuaP39hRnMYAQk93vmhm7UMKmIEecKdbXTzm9bVhcaL62:wBa0mkspJtyYA/vMHTi9bD

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

C2

216.250.251.104:2028

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Payload.exe

pid process

4380 Payload.exe

pid	process
4380	Payload.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe

Drops startup file 2 IoCs

Processes:

8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exePayload.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Payload.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Payload.exe"	8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

Payload.exe

description	pid	process
Token: SeDebugPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe
Token: 33	4380	Payload.exe
Token: SeIncBasePriorityPrivilege	4380	Payload.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe

description	pid	process	target process
PID 4536 wrote to memory of 4380	4536	8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe	Payload.exe
PID 4536 wrote to memory of 4380	4536	8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe	Payload.exe
PID 4536 wrote to memory of 4380	4536	8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe	Payload.exe
PID 4536 wrote to memory of 1944	4536	8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe	attrib.exe
PID 4536 wrote to memory of 1944	4536	8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe	attrib.exe
PID 4536 wrote to memory of 1944	4536	8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1944 attrib.exe

pid	process
1944	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe
"C:\Users\Admin\AppData\Local\Temp\8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4536

C:\Users\Admin\AppData\Roaming\Payload.exe
"C:\Users\Admin\AppData\Roaming\Payload.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Payload.exe"
2⤵
- Views/modifies file attributes
PID:1944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
Filesize
1KB

MD5
ccb4adf1a003df614fb1f8039d1be10a

SHA1
36d91fb76a2ef18acaf219327ff316a8a95d83b6

SHA256
84ad0844d225991376347b926b55bcde878f85b6f521fc3dc17e5e657663b9bf

SHA512
6fafee22e24d591ad56f5d41bbaeeae065aa81fac92e82372bba1288970926d155374e99e60aeaee7ba86e5ace112ad66e7f1169b4a940e50e0a849faec87184

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
Filesize
1KB

MD5
e4c1ab0952ee24e83a8338bd593e7b0a

SHA1
108f2750a77739f5318574aa65287fb9a36fcbb6

SHA256
6315a99f3c3f09f568c15aed16b9348da10a8b8b1f3e43322232350fb64f4f59

SHA512
b189f4cb4438e1017d2ca21dd432acf987f57ce48f141f47a1acde2bf813f35742b8180cc4c48d363d609b91697c4f7c0293c088101f79f82bb66e96422dd7e6

Download Submit
C:\Users\Admin\AppData\Roaming\Payload.exe
Filesize
27KB

MD5
47bea8a28b1e81e3342d594fc57acd8e

SHA1
d301e8985e53b7baabf9b45df087a017e3817742

SHA256
8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4

SHA512
d5f2bfa425fa0c8d7fe2531b57ed9dbe5ca9b8bb8b7a868e39b251182446a22bcf01c3181d17b3362bc2a76b56cda1e504db2436fafbf922ee2120f76e8d00b6

Download Submit
C:\Users\Admin\AppData\Roaming\Payload.exe
Filesize
27KB

MD5
47bea8a28b1e81e3342d594fc57acd8e

SHA1
d301e8985e53b7baabf9b45df087a017e3817742

SHA256
8f04eb500e66a053fa3e6e8a9900e94e794218253a172265c3a881db6f65faf4

SHA512
d5f2bfa425fa0c8d7fe2531b57ed9dbe5ca9b8bb8b7a868e39b251182446a22bcf01c3181d17b3362bc2a76b56cda1e504db2436fafbf922ee2120f76e8d00b6

Download Submit
memory/1944-138-0x0000000000000000-mapping.dmp

Download
memory/4380-135-0x0000000000000000-mapping.dmp

Download
memory/4380-141-0x0000000005B50000-0x0000000005BE2000-memory.dmp

Filesize
584KB

Download
memory/4380-142-0x0000000005B30000-0x0000000005B3A000-memory.dmp

Filesize
40KB

Download
memory/4536-132-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/4536-133-0x0000000004C70000-0x0000000004D0C000-memory.dmp

Filesize
624KB

Download
memory/4536-134-0x0000000005C40000-0x00000000061E4000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads