njrat | cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078

Analysis

max time kernel
152s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2022 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Size

23KB
MD5

69fd8c75298e3c9a98f8cad5321d0220
SHA1

abef1bf2740d680aca21000c7fb0d7feb0ceeca3
SHA256

cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078
SHA512

83d53d16a69494491368d8669316f5d1a9dfdd42074773919c6174d4cdc6cfc98e0efb1dbdbb0f0528efb5e2549ec99f452d3a33aa6dde5dbf95853a01c42eb3
SSDEEP

384:bc68yCaUVIhboNgfEimfkNzayS06vg5UhcpxH7ndmRvR6JZlbw8hqIusZzZDI:3873kgNfoaf6ARpcnu7

Score

10^/10

njrat evasion trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

5036 netsh.exe

pid	process
5036	netsh.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe

description	pid	process
Token: SeDebugPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: 33	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
Token: SeIncBasePriorityPrivilege	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe

description	pid	process	target process
PID 1268 wrote to memory of 5036	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe	netsh.exe
PID 1268 wrote to memory of 5036	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe	netsh.exe
PID 1268 wrote to memory of 5036	1268	cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe
"C:\Users\Admin\AppData\Local\Temp\cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe" "cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:5036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-132-0x00000000748D0000-0x0000000074E81000-memory.dmp

Filesize
5.7MB

Download
memory/5036-133-0x0000000000000000-mapping.dmp

Download