njrat | c241359bb16c2f829556a085615e945964f419c8b6bf4fe057e074a42debc61d

General

Target

C241359BB16C2F829556A085615E945964F419C8B6BF4.exe
Size

37KB
MD5

baa72f0a4d0ec5929523d963530f918c
SHA1

69c59ca8edc4f143dabfb5b886ac134feae552ee
SHA256

c241359bb16c2f829556a085615e945964f419c8b6bf4fe057e074a42debc61d
SHA512

56e429c2590c290d7ecfcdfca5d219a51a9d00b61909483faca4cd4ba9dd9de250303e38d02198d1ae77ebd87207ba8d3c84d77ecb80cc17fcd6b975684b30c6
SSDEEP

384:Tqick7sgwi+tx3+j/NSyszg8QPBI3mmTlrAF+rMRTyN/0L+EcoinblneHQM3epzn:W5kQLCNhszg8QeWmBrM+rMRa8NuujQt

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

2.tcp.ngrok.io:15117

Mutex

0235ee83238daee159f7e9875fd5f233

Attributes

reg_key
0235ee83238daee159f7e9875fd5f233
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

1736 server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

848 netsh.exe
Loads dropped DLL 1 IoCs

Processes:

C241359BB16C2F829556A085615E945964F419C8B6BF4.exe

pid process

1680 C241359BB16C2F829556A085615E945964F419C8B6BF4.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1736	server.exe

pid	process
848	netsh.exe

pid	process
1680	C241359BB16C2F829556A085615E945964F419C8B6BF4.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	1736	server.exe
Token: 33	1736	server.exe
Token: SeIncBasePriorityPrivilege	1736	server.exe
Token: 33	1736	server.exe
Token: SeIncBasePriorityPrivilege	1736	server.exe
Token: 33	1736	server.exe
Token: SeIncBasePriorityPrivilege	1736	server.exe
Token: 33	1736	server.exe
Token: SeIncBasePriorityPrivilege	1736	server.exe
Token: 33	1736	server.exe
Token: SeIncBasePriorityPrivilege	1736	server.exe
Token: 33	1736	server.exe
Token: SeIncBasePriorityPrivilege	1736	server.exe
Token: 33	1736	server.exe
Token: SeIncBasePriorityPrivilege	1736	server.exe
Token: 33	1736	server.exe
Token: SeIncBasePriorityPrivilege	1736	server.exe
Token: 33	1736	server.exe
Token: SeIncBasePriorityPrivilege	1736	server.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

C241359BB16C2F829556A085615E945964F419C8B6BF4.exeserver.exe

description	pid	process	target process
PID 1680 wrote to memory of 1736	1680	C241359BB16C2F829556A085615E945964F419C8B6BF4.exe	server.exe
PID 1680 wrote to memory of 1736	1680	C241359BB16C2F829556A085615E945964F419C8B6BF4.exe	server.exe
PID 1680 wrote to memory of 1736	1680	C241359BB16C2F829556A085615E945964F419C8B6BF4.exe	server.exe
PID 1680 wrote to memory of 1736	1680	C241359BB16C2F829556A085615E945964F419C8B6BF4.exe	server.exe
PID 1736 wrote to memory of 848	1736	server.exe	netsh.exe
PID 1736 wrote to memory of 848	1736	server.exe	netsh.exe
PID 1736 wrote to memory of 848	1736	server.exe	netsh.exe
PID 1736 wrote to memory of 848	1736	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\C241359BB16C2F829556A085615E945964F419C8B6BF4.exe
"C:\Users\Admin\AppData\Local\Temp\C241359BB16C2F829556A085615E945964F419C8B6BF4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
37KB

MD5
baa72f0a4d0ec5929523d963530f918c

SHA1
69c59ca8edc4f143dabfb5b886ac134feae552ee

SHA256
c241359bb16c2f829556a085615e945964f419c8b6bf4fe057e074a42debc61d

SHA512
56e429c2590c290d7ecfcdfca5d219a51a9d00b61909483faca4cd4ba9dd9de250303e38d02198d1ae77ebd87207ba8d3c84d77ecb80cc17fcd6b975684b30c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
37KB

MD5
baa72f0a4d0ec5929523d963530f918c

SHA1
69c59ca8edc4f143dabfb5b886ac134feae552ee

SHA256
c241359bb16c2f829556a085615e945964f419c8b6bf4fe057e074a42debc61d

SHA512
56e429c2590c290d7ecfcdfca5d219a51a9d00b61909483faca4cd4ba9dd9de250303e38d02198d1ae77ebd87207ba8d3c84d77ecb80cc17fcd6b975684b30c6

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
37KB

MD5
baa72f0a4d0ec5929523d963530f918c

SHA1
69c59ca8edc4f143dabfb5b886ac134feae552ee

SHA256
c241359bb16c2f829556a085615e945964f419c8b6bf4fe057e074a42debc61d

SHA512
56e429c2590c290d7ecfcdfca5d219a51a9d00b61909483faca4cd4ba9dd9de250303e38d02198d1ae77ebd87207ba8d3c84d77ecb80cc17fcd6b975684b30c6

Download Submit
memory/848-63-0x0000000000000000-mapping.dmp

Download
memory/1680-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1680-55-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1680-61-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-57-0x0000000000000000-mapping.dmp

Download
memory/1736-62-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-65-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing