njrat | 9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0

General

Target

9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0.exe
Size

104KB
MD5

612c66a36515026a56be7247c26fd640
SHA1

6922a1cc14516d538e9e4eceb7e5fd8d1b13b15e
SHA256

9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0
SHA512

144ddf3583f3beb070da6af93c7aa568dfc48f312be6e233be45b1f11d0c68aea27671cbfc0da1ce260d43a96b352a34c296490f2addd345aba8ddb1eaddb9f5
SSDEEP

1536:fv35cLcZpzG087Pb5xAr9DoM25s5jKXQqoXihO+NA43FizmPlQ:fugx8zb5OpDoSU2i0+fwOlQ

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
4476	System.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4996	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f478c0e74b869a31fe8f76f9aaf004a8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.exe\" .."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f478c0e74b869a31fe8f76f9aaf004a8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.exe\" .."	System.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe
Token: 33	4476	System.exe
Token: SeIncBasePriorityPrivilege	4476	System.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4476	4324	9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0.exe	87
PID 4324 wrote to memory of 4476	4324	9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0.exe	87
PID 4476 wrote to memory of 4996	4476	System.exe	91
PID 4476 wrote to memory of 4996	4476	System.exe	91

C:\Users\Admin\AppData\Local\Temp\9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0.exe
"C:\Users\Admin\AppData\Local\Temp\9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\System.exe
  "C:\Users\Admin\AppData\Local\Temp\System.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SYSTEM32\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System.exe" "System.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
104KB

MD5
612c66a36515026a56be7247c26fd640

SHA1
6922a1cc14516d538e9e4eceb7e5fd8d1b13b15e

SHA256
9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0

SHA512
144ddf3583f3beb070da6af93c7aa568dfc48f312be6e233be45b1f11d0c68aea27671cbfc0da1ce260d43a96b352a34c296490f2addd345aba8ddb1eaddb9f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
104KB

MD5
612c66a36515026a56be7247c26fd640

SHA1
6922a1cc14516d538e9e4eceb7e5fd8d1b13b15e

SHA256
9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0

SHA512
144ddf3583f3beb070da6af93c7aa568dfc48f312be6e233be45b1f11d0c68aea27671cbfc0da1ce260d43a96b352a34c296490f2addd345aba8ddb1eaddb9f5

Download Submit
memory/4324-132-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/4324-133-0x00007FF98FA70000-0x00007FF990531000-memory.dmp

Filesize
10.8MB

Download
memory/4324-137-0x00007FF98FA70000-0x00007FF990531000-memory.dmp

Filesize
10.8MB

Download
memory/4476-138-0x00007FF98FA70000-0x00007FF990531000-memory.dmp

Filesize
10.8MB

Download
memory/4476-140-0x00007FF98FA70000-0x00007FF990531000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing