njrat | ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc

General

Target

ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe
Size

29KB
MD5

536d55f94c3a53510b6f088ac62c0980
SHA1

32ef91c30f8cde0426781761c0b4d86768e82ae4
SHA256

ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc
SHA512

22f892cc91a83cc5a3c80830eb50d7baff7ac053f4ec491de7e0871d89457c4a53b7804a76cb7850133b10ed9e4f2772dbf199e22fb982d25dfcad20c2b28cee
SSDEEP

768:yj77ucYfKQTtzjAqc3eUBKh0p29SgRMy6:y7hWVUJZKhG29j96

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

setokaiba.no-ip.biz:1177

Mutex

08f4dc96bbb7af09d1a37fe35c75a42f

Attributes

reg_key
08f4dc96bbb7af09d1a37fe35c75a42f
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

explorer.exe

pid process

932 explorer.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

832 netsh.exe

pid	process
832	netsh.exe

Drops startup file 2 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08f4dc96bbb7af09d1a37fe35c75a42f.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08f4dc96bbb7af09d1a37fe35c75a42f.exe	explorer.exe

Loads dropped DLL 1 IoCs

Processes:

ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe

pid process

2020 ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe

pid	process
2020	ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\08f4dc96bbb7af09d1a37fe35c75a42f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe\" .."	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\08f4dc96bbb7af09d1a37fe35c75a42f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe\" .."	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

explorer.exe

pid	process
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe
932	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

explorer.exe

description pid process

Token: SeDebugPrivilege 932 explorer.exe

description	pid	process
Token: SeDebugPrivilege	932	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exeexplorer.exe

description	pid	process	target process
PID 2020 wrote to memory of 932	2020	ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe	explorer.exe
PID 2020 wrote to memory of 932	2020	ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe	explorer.exe
PID 2020 wrote to memory of 932	2020	ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe	explorer.exe
PID 2020 wrote to memory of 932	2020	ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe	explorer.exe
PID 932 wrote to memory of 832	932	explorer.exe	netsh.exe
PID 932 wrote to memory of 832	932	explorer.exe	netsh.exe
PID 932 wrote to memory of 832	932	explorer.exe	netsh.exe
PID 932 wrote to memory of 832	932	explorer.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe
"C:\Users\Admin\AppData\Local\Temp\ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\explorer.exe
"C:\Users\Admin\AppData\Local\Temp\explorer.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "explorer.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\explorer.exe
Filesize
29KB

MD5
536d55f94c3a53510b6f088ac62c0980

SHA1
32ef91c30f8cde0426781761c0b4d86768e82ae4

SHA256
ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc

SHA512
22f892cc91a83cc5a3c80830eb50d7baff7ac053f4ec491de7e0871d89457c4a53b7804a76cb7850133b10ed9e4f2772dbf199e22fb982d25dfcad20c2b28cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\explorer.exe
Filesize
29KB

MD5
536d55f94c3a53510b6f088ac62c0980

SHA1
32ef91c30f8cde0426781761c0b4d86768e82ae4

SHA256
ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc

SHA512
22f892cc91a83cc5a3c80830eb50d7baff7ac053f4ec491de7e0871d89457c4a53b7804a76cb7850133b10ed9e4f2772dbf199e22fb982d25dfcad20c2b28cee

Download Submit
\Users\Admin\AppData\Local\Temp\explorer.exe
Filesize
29KB

MD5
536d55f94c3a53510b6f088ac62c0980

SHA1
32ef91c30f8cde0426781761c0b4d86768e82ae4

SHA256
ff8f477d7ff5e9ae54c5ba80be1f1884773e7da8dccb737508adba85413326cc

SHA512
22f892cc91a83cc5a3c80830eb50d7baff7ac053f4ec491de7e0871d89457c4a53b7804a76cb7850133b10ed9e4f2772dbf199e22fb982d25dfcad20c2b28cee

Download Submit
memory/832-61-0x0000000000000000-mapping.dmp

Download
memory/932-57-0x0000000000000000-mapping.dmp

Download
memory/932-64-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/932-65-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-62-0x0000000074C80000-0x000000007522B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads