njrat | 9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371

General

Target

9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
Size

699KB
MD5

5abd9a7429df3a6f3fab1c4da9740e2e
SHA1

b6c1833a87cc3f904bfe8356c677cd4f57b3aafd
SHA256

9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371
SHA512

7810650ed0725d4f201d4864d21ee32d32b5a134af6d5653cee74c2af8e4ed8ec4bba4a83a633188b0ccf4176dead3874c7016cfe666431dc84e9cdb97c5b4de
SSDEEP

12288:IhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a6AiDyc:wRmJkcoQricOIQxiZY1iaDiDyc

Score

10^/10

njrat slaves1 trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

Slaves1

C2

zafarullah.zapto.org:1604

Mutex

d2af1d61020cbaaa665444e49c2e50d8

Attributes

reg_key
d2af1d61020cbaaa665444e49c2e50d8
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe

pid process

804 9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
Loads dropped DLL 1 IoCs

Processes:

9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe

pid process

1280 9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe

pid	process
804	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe

description	pid	process	target process
PID 1280 set thread context of 804	1280	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000007933bae8aea4d539d59b66246155e20da6d242a99776e7a0a37d7b52082f0fcd000000000e8000000002000020000000425db869e66128d4a9f34309a6f952c3ca2cafc6ba2882ed66edbcdc8e9d362020000000b5ba559582602aecb971a08881aa65d588d809f1ebc0c56322f4eff658770daa40000000a3dfe77a321669039bce8c150299e938541d96f5cf4220141635f07afd766816a9b45be056c8d8aedf3c8d4a7b5bfd80abef397239c3d7ef262517001fda1dd7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50696D31-42D1-11ED-93F0-EAF6071D98F9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a30000000002000000000010660000000100002000000045355ed9db00d8d1adce06cea3c1f9e1ad2033ac28c54a57cfb916986706da87000000000e80000000020000200000003fecf1e4ea0f3fbdafd840a6bb4ee4a58d1f37485acd0350ec81e1ab0e2ec15690000000f82f21bd8d3d1d6001fc9956973c2bd8a0a2d83f7bb1b7b28239048c52a54ae217062b3b82975a89f340d6fd90be865aaa59e81e5836b4f9c5f7b25039d4a0a571a8b7fc32563c1894dcb13808c1120716931d40c93dd2ce4ba272ce2c1c917319a8636a5e13abefad71949777bfdacb7746f82a2bcd571a0bb8052a00f4bd9895b728491232628b9f79e0fad8bcf54f40000000c4f10557fa659b7e7e7f95bd3a86a0d9cf792dde3974ef735cca4d011ec9e5bb0b838b97cc222d01e7bf0640f8b8a22e29ecea220edaebe795f75b673d0a24e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d3e935ded6d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371535204"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe

pid	process
1280	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
1280	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

848 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

848 iexplore.exe
848 iexplore.exe
588 IEXPLORE.EXE
588 IEXPLORE.EXE
588 IEXPLORE.EXE
588 IEXPLORE.EXE

pid	process
848	iexplore.exe

pid	process
848	iexplore.exe
848	iexplore.exe
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exeiexplore.exe

description	pid	process	target process
PID 1280 wrote to memory of 804	1280	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
PID 1280 wrote to memory of 804	1280	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
PID 1280 wrote to memory of 804	1280	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
PID 1280 wrote to memory of 804	1280	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
PID 1280 wrote to memory of 804	1280	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
PID 1280 wrote to memory of 804	1280	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
PID 804 wrote to memory of 848	804	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	iexplore.exe
PID 804 wrote to memory of 848	804	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	iexplore.exe
PID 804 wrote to memory of 848	804	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	iexplore.exe
PID 804 wrote to memory of 848	804	9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe	iexplore.exe
PID 848 wrote to memory of 588	848	iexplore.exe	IEXPLORE.EXE
PID 848 wrote to memory of 588	848	iexplore.exe	IEXPLORE.EXE
PID 848 wrote to memory of 588	848	iexplore.exe	IEXPLORE.EXE
PID 848 wrote to memory of 588	848	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
"C:\Users\Admin\AppData\Local\Temp\9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
"C:\Users\Admin\AppData\Local\Temp\9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
Filesize
699KB

MD5
5abd9a7429df3a6f3fab1c4da9740e2e

SHA1
b6c1833a87cc3f904bfe8356c677cd4f57b3aafd

SHA256
9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371

SHA512
7810650ed0725d4f201d4864d21ee32d32b5a134af6d5653cee74c2af8e4ed8ec4bba4a83a633188b0ccf4176dead3874c7016cfe666431dc84e9cdb97c5b4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\N37RYBP5.txt
Filesize
598B

MD5
7f6a0f68ac52cba2f4ff3c06f1293be4

SHA1
366a6208d03207542323cb86963dea726f48e48b

SHA256
527397cce8588196cf61d76769bb15fc251b0841a094b52a1ee745ee0ba10389

SHA512
e1d3fb3b52a7e6ef76a879712c4d611536c2067e97b341598f2c37fcf3490c450706a2866f5a13a607a988fb4ee422fc82b4b3ec7c270f1d67bfd3eb3bb5a5c2

Download Submit
\Users\Admin\AppData\Local\Temp\9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371.exe
Filesize
699KB

MD5
5abd9a7429df3a6f3fab1c4da9740e2e

SHA1
b6c1833a87cc3f904bfe8356c677cd4f57b3aafd

SHA256
9753221afc815352348934c615626463392b7bc6730bd4f2b53ad3d268532371

SHA512
7810650ed0725d4f201d4864d21ee32d32b5a134af6d5653cee74c2af8e4ed8ec4bba4a83a633188b0ccf4176dead3874c7016cfe666431dc84e9cdb97c5b4de

Download Submit
memory/804-56-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/804-58-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/804-59-0x00000000000C8B0E-mapping.dmp

Download
memory/804-62-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/804-64-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/1280-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads