njrat | a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc

General

Target

a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
Size

711KB
MD5

61ad9e5151fa5909d9e5ef8881b15870
SHA1

e6853896639f59c4fadc69fa5e025f50c5daab52
SHA256

a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc
SHA512

a29ee9b434f148c3c43c0121e945493f6c86504019e9dfad5887a211bb561200674ddbf17d42ea1103e209b69045e872dd020f1dfa940c0c22522a2a60c3edd1
SSDEEP

12288:jhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4agIe4wPx/K:pRmJkcoQricOIQxiZY1iagIhe/K

Score

10^/10

njrat trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe

description	pid	process	target process
PID 1968 set thread context of 1584	1968	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000c736c0066d605f6be4a0b3ee2dd3ac45d6d3f12992f4859fe67587b44b7a37b4000000000e800000000200002000000008b1fdd3319c93407687a41177fe460c396fdfc7b170501e0ad6270d1583e9a990000000888bd76164c95a249b006d293d652ecf2854750cc32c4437da0779bb1fb81d2646f2587dd7f678a41b2391b1b2b7f34a886e72577a7ce4cc03ae5e11a71cb095f78a5b71d7bf51cbcb977238f28c2c8fbe6f0e626030522d331e86bc41872d26dce7c7776fbaeb1520e180dddecb0614441212de4c257cecabd1a3b2d662d58d95df54fb624a552e5afe5bfbc7fb8b1840000000288935735be75fdd8736b84f0ffcc4ab7426e4016a234af28c332696626a009843e673524b852f6db1265fb335c0ae55b287e7f0ebaea4369ed8310cf0e6fd9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371536889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000874073f8f519ed805ad696ebf0a55b522c9289a5ad0b5416935c2ac8acc304cf000000000e8000000002000020000000a3c3b5a0eebd26eb35b3c1446d4d6687372d3c749548cbb3daee0311a673c20b2000000086b45f4f30b375cf8decd4e2cc1f3787c14f2d63b5c6e78ce8bef732f8b757e940000000f8be8863181f8868c7a0cf574efaad2cda214de8edee002aefb788e16f8376dab622a310a4f019c4b13e9ca05f8e150ffc46bbec578f2be2fe7d5852413820c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3ADC5191-42D5-11ED-AEF5-42FEA5F7B9B2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70150424e2d6d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1492 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1492 iexplore.exe
1492 iexplore.exe
1884 IEXPLORE.EXE
1884 IEXPLORE.EXE
1884 IEXPLORE.EXE
1884 IEXPLORE.EXE

pid	process
1492	iexplore.exe

pid	process
1492	iexplore.exe
1492	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exea2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exeiexplore.exe

description	pid	process	target process
PID 1968 wrote to memory of 1584	1968	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
PID 1968 wrote to memory of 1584	1968	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
PID 1968 wrote to memory of 1584	1968	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
PID 1968 wrote to memory of 1584	1968	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
PID 1968 wrote to memory of 1584	1968	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
PID 1968 wrote to memory of 1584	1968	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
PID 1968 wrote to memory of 1584	1968	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
PID 1968 wrote to memory of 1584	1968	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
PID 1584 wrote to memory of 1492	1584	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	iexplore.exe
PID 1584 wrote to memory of 1492	1584	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	iexplore.exe
PID 1584 wrote to memory of 1492	1584	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	iexplore.exe
PID 1584 wrote to memory of 1492	1584	a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe	iexplore.exe
PID 1492 wrote to memory of 1884	1492	iexplore.exe	IEXPLORE.EXE
PID 1492 wrote to memory of 1884	1492	iexplore.exe	IEXPLORE.EXE
PID 1492 wrote to memory of 1884	1492	iexplore.exe	IEXPLORE.EXE
PID 1492 wrote to memory of 1884	1492	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
"C:\Users\Admin\AppData\Local\Temp\a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe
"C:\Users\Admin\AppData\Local\Temp\a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=a2ca2e6e2a347594ecaa90b1e380fd5ef6090968bcd4296ffc9b0f6d39c9c3dc.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1492 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SIZFUEWU.txt
Filesize
597B

MD5
b99209dc74b6f6da0cf1f3a33b32063b

SHA1
2a802d65acced93c2c801aa6d7fa5ee00de044fb

SHA256
50a20a22744bafc2055450cbd53ec1f0ce4e6334ad0ae1a4fe13e10ec3fc6fd1

SHA512
da97bf67a2bb8f716da043c0c81f713b6016a02f68158f9fbdca6f7a8434cc308bf4133717a5b8aea86795ae49d8de0d235e4ee8103bec728df7c3467689b907

Download Submit
memory/1584-55-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1584-56-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1584-58-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1584-59-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1584-60-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1584-61-0x000000000040890E-mapping.dmp

Download
memory/1584-64-0x0000000000402000-0x0000000000408A00-memory.dmp

Filesize
26KB

Download
memory/1584-63-0x0000000000402000-0x0000000000408A00-memory.dmp

Filesize
26KB

Download
memory/1968-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads