njrat | d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98

General

Target

d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
Size

472KB
MD5

73490eea715262aa6dbc8a0b777adf30
SHA1

013d11b58619e035957fe8ee8ccfe35904f5011f
SHA256

d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98
SHA512

069bd28f7180cde99f88ca6561ed56c04f4721f22f57925d9701176406d45d2a72baa66fab040888fc9b430624d2cdf5067e860d393d42759077e587dc84398b
SSDEEP

12288:atD+nyKFY1iHPeugsRYgX+wCk7aszyrZ:0ynymY1iHlVOnZ

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

blackman00000.no-ip.biz:1995

Mutex

c25a09183d9a8afb0f4533b14dd064b5

Attributes

reg_key
c25a09183d9a8afb0f4533b14dd064b5
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Explorer.exe

pid process

1592 Explorer.exe
Loads dropped DLL 1 IoCs

Processes:

d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe

pid process

1616 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe

pid	process
1592	Explorer.exe

pid	process
1616	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe

description	pid	process	target process
PID 948 set thread context of 1616	948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exeExplorer.exe

pid	process
948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
1592	Explorer.exe
1592	Explorer.exe
1592	Explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exeExplorer.exe

description	pid	process
Token: SeDebugPrivilege	948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
Token: SeDebugPrivilege	1592	Explorer.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exed673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exeExplorer.exe

description	pid	process	target process
PID 948 wrote to memory of 1616	948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
PID 948 wrote to memory of 1616	948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
PID 948 wrote to memory of 1616	948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
PID 948 wrote to memory of 1616	948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
PID 948 wrote to memory of 1616	948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
PID 948 wrote to memory of 1616	948	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
PID 1616 wrote to memory of 1592	1616	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	Explorer.exe
PID 1616 wrote to memory of 1592	1616	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	Explorer.exe
PID 1616 wrote to memory of 1592	1616	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	Explorer.exe
PID 1616 wrote to memory of 1592	1616	d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe	Explorer.exe
PID 1592 wrote to memory of 764	1592	Explorer.exe	Explorer.exe
PID 1592 wrote to memory of 764	1592	Explorer.exe	Explorer.exe
PID 1592 wrote to memory of 764	1592	Explorer.exe	Explorer.exe
PID 1592 wrote to memory of 764	1592	Explorer.exe	Explorer.exe

C:\Users\Admin\AppData\Local\Temp\d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
"C:\Users\Admin\AppData\Local\Temp\d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
C:\Users\Admin\AppData\Local\Temp\d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Roaming\Explorer.exe
"C:\Users\Admin\AppData\Roaming\Explorer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Roaming\Explorer.exe
C:\Users\Admin\AppData\Roaming\Explorer.exe
4⤵
PID:764

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Explorer.exe
Filesize
472KB

MD5
73490eea715262aa6dbc8a0b777adf30

SHA1
013d11b58619e035957fe8ee8ccfe35904f5011f

SHA256
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98

SHA512
069bd28f7180cde99f88ca6561ed56c04f4721f22f57925d9701176406d45d2a72baa66fab040888fc9b430624d2cdf5067e860d393d42759077e587dc84398b

Download Submit
C:\Users\Admin\AppData\Roaming\Explorer.exe
Filesize
472KB

MD5
73490eea715262aa6dbc8a0b777adf30

SHA1
013d11b58619e035957fe8ee8ccfe35904f5011f

SHA256
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98

SHA512
069bd28f7180cde99f88ca6561ed56c04f4721f22f57925d9701176406d45d2a72baa66fab040888fc9b430624d2cdf5067e860d393d42759077e587dc84398b

Download Submit
\Users\Admin\AppData\Roaming\Explorer.exe
Filesize
472KB

MD5
73490eea715262aa6dbc8a0b777adf30

SHA1
013d11b58619e035957fe8ee8ccfe35904f5011f

SHA256
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98

SHA512
069bd28f7180cde99f88ca6561ed56c04f4721f22f57925d9701176406d45d2a72baa66fab040888fc9b430624d2cdf5067e860d393d42759077e587dc84398b

Download Submit
memory/948-65-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/948-55-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/948-66-0x0000000000D86000-0x0000000000D97000-memory.dmp

Filesize
68KB

Download
memory/948-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/948-64-0x0000000000D86000-0x0000000000D97000-memory.dmp

Filesize
68KB

Download
memory/1592-68-0x0000000000000000-mapping.dmp

Download
memory/1592-73-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1592-74-0x00000000002B6000-0x00000000002C7000-memory.dmp

Filesize
68KB

Download
memory/1592-75-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1592-76-0x00000000002B6000-0x00000000002C7000-memory.dmp

Filesize
68KB

Download
memory/1616-63-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1616-61-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1616-57-0x000000000040749E-mapping.dmp

Download
memory/1616-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1616-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1616-72-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads