njrat | 2ff87e3a4ca06c7e160524b391317b7a9d824eb3ee239651bcf7bf413dd45336

General

Target

0x000b000000012315-61.exe
Size

23KB
MD5

142313d7733b824409a828920e97ace1
SHA1

12f6be17f7d109e70e10d787203ee3ce501b4ea3
SHA256

2ff87e3a4ca06c7e160524b391317b7a9d824eb3ee239651bcf7bf413dd45336
SHA512

88d87acb4cf5e85e1753472fccad7105647680d5cc29de628617361ada32cf635b1dc95745e1aba72070301419a77b16b5268b855c4d1b721405d292909750c7
SSDEEP

384:O8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZK9:BXcwt3tRpcnu1

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

2.tcp.ngrok.io:14402

Mutex

5cb3161ea3511d9f5e42e30a884c6964

Attributes

reg_key
5cb3161ea3511d9f5e42e30a884c6964
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

xuy.exe

pid process

3744 xuy.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

920 netsh.exe

pid	process
3744	xuy.exe

pid	process
920	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0x000b000000012315-61.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	0x000b000000012315-61.exe

Drops startup file 2 IoCs

Processes:

xuy.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cb3161ea3511d9f5e42e30a884c6964.exe	xuy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cb3161ea3511d9f5e42e30a884c6964.exe	xuy.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

xuy.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cb3161ea3511d9f5e42e30a884c6964 = "\"C:\\Users\\Admin\\AppData\\Roaming\\xuy.exe\" .."	xuy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cb3161ea3511d9f5e42e30a884c6964 = "\"C:\\Users\\Admin\\AppData\\Roaming\\xuy.exe\" .."	xuy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

xuy.exe

description	pid	process
Token: SeDebugPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe
Token: 33	3744	xuy.exe
Token: SeIncBasePriorityPrivilege	3744	xuy.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0x000b000000012315-61.exexuy.exe

description	pid	process	target process
PID 2268 wrote to memory of 3744	2268	0x000b000000012315-61.exe	xuy.exe
PID 2268 wrote to memory of 3744	2268	0x000b000000012315-61.exe	xuy.exe
PID 2268 wrote to memory of 3744	2268	0x000b000000012315-61.exe	xuy.exe
PID 3744 wrote to memory of 920	3744	xuy.exe	netsh.exe
PID 3744 wrote to memory of 920	3744	xuy.exe	netsh.exe
PID 3744 wrote to memory of 920	3744	xuy.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\0x000b000000012315-61.exe
"C:\Users\Admin\AppData\Local\Temp\0x000b000000012315-61.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Roaming\xuy.exe
"C:\Users\Admin\AppData\Roaming\xuy.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\xuy.exe" "xuy.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\xuy.exe
Filesize
23KB

MD5
142313d7733b824409a828920e97ace1

SHA1
12f6be17f7d109e70e10d787203ee3ce501b4ea3

SHA256
2ff87e3a4ca06c7e160524b391317b7a9d824eb3ee239651bcf7bf413dd45336

SHA512
88d87acb4cf5e85e1753472fccad7105647680d5cc29de628617361ada32cf635b1dc95745e1aba72070301419a77b16b5268b855c4d1b721405d292909750c7

Download Submit
C:\Users\Admin\AppData\Roaming\xuy.exe
Filesize
23KB

MD5
142313d7733b824409a828920e97ace1

SHA1
12f6be17f7d109e70e10d787203ee3ce501b4ea3

SHA256
2ff87e3a4ca06c7e160524b391317b7a9d824eb3ee239651bcf7bf413dd45336

SHA512
88d87acb4cf5e85e1753472fccad7105647680d5cc29de628617361ada32cf635b1dc95745e1aba72070301419a77b16b5268b855c4d1b721405d292909750c7

Download Submit
memory/920-138-0x0000000000000000-mapping.dmp

Download
memory/2268-132-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/2268-136-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/3744-133-0x0000000000000000-mapping.dmp

Download
memory/3744-137-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/3744-139-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads