njrat | 60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572

General

Target

60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe
Size

29KB
MD5

70403e78e612e435c81f467218ab19c0
SHA1

ec2408407bb925b36adf3372d83480fc67bf4986
SHA256

60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572
SHA512

04fc7c62b73d26c0558592c86975e3a3eeb9fb122f13a40987bbe36470cc0002863048ea216eba0b736fd667a8730cbf0295e7895f2a36649c27d0db7e0e8a20
SSDEEP

384:h9gJGJl7tj1Msagab1h5Vh+2CWmqDebD59ePbGBsbh0w4wlAokw9OhgOL1vYRGOf:ht7nMsanzR+2cqEDveyBKh0p29SgR4w

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

ahmed12300.no-ip.biz:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Trojan.exe

pid process

1736 Trojan.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1656 netsh.exe
Loads dropped DLL 1 IoCs

Processes:

60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe

pid process

1760 60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1656	netsh.exe

pid	process
1760	60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

Trojan.exe

pid	process
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe
1736	Trojan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Trojan.exe

description pid process

Token: SeDebugPrivilege 1736 Trojan.exe

description	pid	process
Token: SeDebugPrivilege	1736	Trojan.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exeTrojan.exe

description	pid	process	target process
PID 1760 wrote to memory of 1736	1760	60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe	Trojan.exe
PID 1760 wrote to memory of 1736	1760	60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe	Trojan.exe
PID 1760 wrote to memory of 1736	1760	60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe	Trojan.exe
PID 1760 wrote to memory of 1736	1760	60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe	Trojan.exe
PID 1736 wrote to memory of 1656	1736	Trojan.exe	netsh.exe
PID 1736 wrote to memory of 1656	1736	Trojan.exe	netsh.exe
PID 1736 wrote to memory of 1656	1736	Trojan.exe	netsh.exe
PID 1736 wrote to memory of 1656	1736	Trojan.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe
"C:\Users\Admin\AppData\Local\Temp\60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
70403e78e612e435c81f467218ab19c0

SHA1
ec2408407bb925b36adf3372d83480fc67bf4986

SHA256
60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572

SHA512
04fc7c62b73d26c0558592c86975e3a3eeb9fb122f13a40987bbe36470cc0002863048ea216eba0b736fd667a8730cbf0295e7895f2a36649c27d0db7e0e8a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
70403e78e612e435c81f467218ab19c0

SHA1
ec2408407bb925b36adf3372d83480fc67bf4986

SHA256
60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572

SHA512
04fc7c62b73d26c0558592c86975e3a3eeb9fb122f13a40987bbe36470cc0002863048ea216eba0b736fd667a8730cbf0295e7895f2a36649c27d0db7e0e8a20

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
70403e78e612e435c81f467218ab19c0

SHA1
ec2408407bb925b36adf3372d83480fc67bf4986

SHA256
60592be138b3cadecfacb31c2ecffad95a20030adae364f4dafb9932d56dd572

SHA512
04fc7c62b73d26c0558592c86975e3a3eeb9fb122f13a40987bbe36470cc0002863048ea216eba0b736fd667a8730cbf0295e7895f2a36649c27d0db7e0e8a20

Download Submit
memory/1656-60-0x0000000000000000-mapping.dmp

Download
memory/1736-56-0x0000000000000000-mapping.dmp

Download
memory/1736-62-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1736-64-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1760-61-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing