njrat | 060032a96340a43e32383dbc1f8723eda945a7d1c3d2f7201b36efd3b98d858e

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-09-2022 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fe56b2f6d9a5c054b76747dd267b97d.exe
Size

333KB
MD5

2fe56b2f6d9a5c054b76747dd267b97d
SHA1

3737c981dab10ca7b676a3456315f7d59ac3f967
SHA256

060032a96340a43e32383dbc1f8723eda945a7d1c3d2f7201b36efd3b98d858e
SHA512

6cf11227817dae593c4e82465dc7080eca4a3767716daf47e53b55938f095349279079a0c7b7e70ed04567896517a2c06d44f540e605e5ec89f51283e6024d85
SSDEEP

6144:H8JsLcpjzTDDmHayakLkrb4NSarQWtT+tG1Xt5ub:8zxzTDWikLSb4NS7ET+tG1XtQb

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

0.tcp.eu.ngrok.io:11177

Mutex

c6e1be96541084b1f53de49f469e8523

Attributes

reg_key
c6e1be96541084b1f53de49f469e8523
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

svchost.exesvchost.exe

pid process

896 svchost.exe
788 svchost.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1760 netsh.exe
Loads dropped DLL 4 IoCs

Processes:

2fe56b2f6d9a5c054b76747dd267b97d.exesvchost.exe

pid process

1604 2fe56b2f6d9a5c054b76747dd267b97d.exe
1604 2fe56b2f6d9a5c054b76747dd267b97d.exe
1604 2fe56b2f6d9a5c054b76747dd267b97d.exe
896 svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
896	svchost.exe
788	svchost.exe

pid	process
1760	netsh.exe

pid	process
1604	2fe56b2f6d9a5c054b76747dd267b97d.exe
1604	2fe56b2f6d9a5c054b76747dd267b97d.exe
1604	2fe56b2f6d9a5c054b76747dd267b97d.exe
896	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svchost.exe

pid process

788 svchost.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	788	svchost.exe
Token: 33	788	svchost.exe
Token: SeIncBasePriorityPrivilege	788	svchost.exe
Token: 33	788	svchost.exe
Token: SeIncBasePriorityPrivilege	788	svchost.exe
Token: 33	788	svchost.exe
Token: SeIncBasePriorityPrivilege	788	svchost.exe
Token: 33	788	svchost.exe
Token: SeIncBasePriorityPrivilege	788	svchost.exe
Token: 33	788	svchost.exe
Token: SeIncBasePriorityPrivilege	788	svchost.exe
Token: 33	788	svchost.exe
Token: SeIncBasePriorityPrivilege	788	svchost.exe
Token: 33	788	svchost.exe
Token: SeIncBasePriorityPrivilege	788	svchost.exe
Token: 33	788	svchost.exe
Token: SeIncBasePriorityPrivilege	788	svchost.exe
Token: 33	788	svchost.exe
Token: SeIncBasePriorityPrivilege	788	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1284 DllHost.exe

pid	process
1284	DllHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2fe56b2f6d9a5c054b76747dd267b97d.exesvchost.exesvchost.exe

description	pid	process	target process
PID 1604 wrote to memory of 896	1604	2fe56b2f6d9a5c054b76747dd267b97d.exe	svchost.exe
PID 1604 wrote to memory of 896	1604	2fe56b2f6d9a5c054b76747dd267b97d.exe	svchost.exe
PID 1604 wrote to memory of 896	1604	2fe56b2f6d9a5c054b76747dd267b97d.exe	svchost.exe
PID 1604 wrote to memory of 896	1604	2fe56b2f6d9a5c054b76747dd267b97d.exe	svchost.exe
PID 896 wrote to memory of 788	896	svchost.exe	svchost.exe
PID 896 wrote to memory of 788	896	svchost.exe	svchost.exe
PID 896 wrote to memory of 788	896	svchost.exe	svchost.exe
PID 896 wrote to memory of 788	896	svchost.exe	svchost.exe
PID 788 wrote to memory of 1760	788	svchost.exe	netsh.exe
PID 788 wrote to memory of 1760	788	svchost.exe	netsh.exe
PID 788 wrote to memory of 1760	788	svchost.exe	netsh.exe
PID 788 wrote to memory of 1760	788	svchost.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\2fe56b2f6d9a5c054b76747dd267b97d.exe
"C:\Users\Admin\AppData\Local\Temp\2fe56b2f6d9a5c054b76747dd267b97d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1604

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:1760

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
37KB

MD5
26519b81ab0c5400711598dab3492da4

SHA1
b28cd0ed6a3af783bddb83c2f2444902335c13a9

SHA256
553765cd10aca67763bfc1c158b143c34769fad1c0e826df511024ea6dce1409

SHA512
677fc384a8b03142fd3f9d4577b34b97b30ad430d96768c6e9d18ac9df8d3e859b77cc38e85d78e1288caa7c34fc7415e0895f8aaeeb6214527497b11e5b8e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
37KB

MD5
26519b81ab0c5400711598dab3492da4

SHA1
b28cd0ed6a3af783bddb83c2f2444902335c13a9

SHA256
553765cd10aca67763bfc1c158b143c34769fad1c0e826df511024ea6dce1409

SHA512
677fc384a8b03142fd3f9d4577b34b97b30ad430d96768c6e9d18ac9df8d3e859b77cc38e85d78e1288caa7c34fc7415e0895f8aaeeb6214527497b11e5b8e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\хуйня.png
Filesize
7KB

MD5
0c3dfadc5c71f2d82c8965465665d48c

SHA1
bbd957499d80fcf556b1f9a8a42686861f34082f

SHA256
c17a05e1f2d2efdd53178f0fb0f9287b16843a2d2fc402273c43018b994c76bf

SHA512
8cda0f1a5c7bab0c5620a278af0e05b748980a484850634071c30a0d75ff8de189ceaa1d7ffbd93d7fc3cee3caa124c201d6b60fdea7bf0889c361ea10b6405d

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
37KB

MD5
26519b81ab0c5400711598dab3492da4

SHA1
b28cd0ed6a3af783bddb83c2f2444902335c13a9

SHA256
553765cd10aca67763bfc1c158b143c34769fad1c0e826df511024ea6dce1409

SHA512
677fc384a8b03142fd3f9d4577b34b97b30ad430d96768c6e9d18ac9df8d3e859b77cc38e85d78e1288caa7c34fc7415e0895f8aaeeb6214527497b11e5b8e2c

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
37KB

MD5
26519b81ab0c5400711598dab3492da4

SHA1
b28cd0ed6a3af783bddb83c2f2444902335c13a9

SHA256
553765cd10aca67763bfc1c158b143c34769fad1c0e826df511024ea6dce1409

SHA512
677fc384a8b03142fd3f9d4577b34b97b30ad430d96768c6e9d18ac9df8d3e859b77cc38e85d78e1288caa7c34fc7415e0895f8aaeeb6214527497b11e5b8e2c

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
37KB

MD5
26519b81ab0c5400711598dab3492da4

SHA1
b28cd0ed6a3af783bddb83c2f2444902335c13a9

SHA256
553765cd10aca67763bfc1c158b143c34769fad1c0e826df511024ea6dce1409

SHA512
677fc384a8b03142fd3f9d4577b34b97b30ad430d96768c6e9d18ac9df8d3e859b77cc38e85d78e1288caa7c34fc7415e0895f8aaeeb6214527497b11e5b8e2c

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
37KB

MD5
26519b81ab0c5400711598dab3492da4

SHA1
b28cd0ed6a3af783bddb83c2f2444902335c13a9

SHA256
553765cd10aca67763bfc1c158b143c34769fad1c0e826df511024ea6dce1409

SHA512
677fc384a8b03142fd3f9d4577b34b97b30ad430d96768c6e9d18ac9df8d3e859b77cc38e85d78e1288caa7c34fc7415e0895f8aaeeb6214527497b11e5b8e2c

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
37KB

MD5
26519b81ab0c5400711598dab3492da4

SHA1
b28cd0ed6a3af783bddb83c2f2444902335c13a9

SHA256
553765cd10aca67763bfc1c158b143c34769fad1c0e826df511024ea6dce1409

SHA512
677fc384a8b03142fd3f9d4577b34b97b30ad430d96768c6e9d18ac9df8d3e859b77cc38e85d78e1288caa7c34fc7415e0895f8aaeeb6214527497b11e5b8e2c

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe
Filesize
37KB

MD5
26519b81ab0c5400711598dab3492da4

SHA1
b28cd0ed6a3af783bddb83c2f2444902335c13a9

SHA256
553765cd10aca67763bfc1c158b143c34769fad1c0e826df511024ea6dce1409

SHA512
677fc384a8b03142fd3f9d4577b34b97b30ad430d96768c6e9d18ac9df8d3e859b77cc38e85d78e1288caa7c34fc7415e0895f8aaeeb6214527497b11e5b8e2c

Download Submit
memory/788-66-0x0000000000000000-mapping.dmp

Download
memory/788-71-0x0000000073310000-0x00000000738BB000-memory.dmp

Filesize
5.7MB

Download
memory/788-74-0x0000000073310000-0x00000000738BB000-memory.dmp

Filesize
5.7MB

Download
memory/896-58-0x0000000000000000-mapping.dmp

Download
memory/896-63-0x0000000073310000-0x00000000738BB000-memory.dmp

Filesize
5.7MB

Download
memory/896-70-0x0000000073310000-0x00000000738BB000-memory.dmp

Filesize
5.7MB

Download
memory/1604-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1760-72-0x0000000000000000-mapping.dmp

Download