njrat | b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d

General

Target

b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe
Size

26KB
MD5

6b83c9f02abe3ce67e3d1b8c5f51d980
SHA1

577ce124a5e939ba7a47aa6b2a11f85550dd42e1
SHA256

b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d
SHA512

9057e733e4a9ef5eeccccc95244e25adc0017e870aebe347afde8df58e8c74a5c682ec5a16184f978a612083f4de32c295fc065d23033bf89a686bf3b497122e
SSDEEP

384:Zf5PFbpphlkPJC5eyq9jbECJ23nzWadIiuj2hd0hAIGTLqNznL78drggtxXJC:ZfDXhdWbEkbi6hAdLgPAtxXA

Score

10^/10

njrat :d trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

:D

C2

governmentservice.servebeer.com:20968

Mutex

dd8213f1bf066875b4691b73b62514e4

Attributes

reg_key
dd8213f1bf066875b4691b73b62514e4
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe

description	pid	process	target process
PID 1396 set thread context of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371545266"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000003ca2d488740cb94d14bb456ea9bb328ff31249e9187e878f9f83d29574012dfe000000000e800000000200002000000003dfe8d146f55737b8e827904e0b93dc82185c18100689a69dbc89074056bc9720000000d8b030768cec96ad644366c00576243f09b797321905756fd8f4b8e63b45d43a400000008e60916887f2e6917e64476ae78399f13c34f0438ef6f7bf9089b281b0551ea3297cc2c652e1579778af72d54eb0c3fdb951a748086c1a3cb34287910a4dce48	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2008b198f5d6d801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000007dab9c432212f070f4bea41f8673cb2e0e75e8b60dbb4f0ee8d36af503b48a84000000000e80000000020000200000005284b142ed3787b49f3d6451b6d13e0ba3e32eeb0b676e1d4821b9144295909490000000b1bc33b8c21f7bf34289fbd1db345c3264c6757ad4d10065acb070e4d3dacf21ca82208c11be4a3238053b28726c16f8e26e081a9399256fba24be03da3e0fd103a38299d26a0b8a60ae670536ce2864a1e8655483d9907343a632cbf3ca066b5934543e9e9dd69197e98ccf8a654025f5f12efeab7bdc9878e3512b058d0187fbd8a79442f157f10f32db6557471559400000008e4e4685dc4a76310c527431b3d30479d146e18864cd803856208651442b3579f425e48cbeb6980709f20049d122c941a1d75940f3bd5ae2ed245d79f59aaa43	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BECB5561-42E8-11ED-BAA3-DE6E3020A1A7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe

description pid process

Token: SeDebugPrivilege 1396 b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2008 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2008 iexplore.exe
2008 iexplore.exe
1684 IEXPLORE.EXE
1684 IEXPLORE.EXE
1684 IEXPLORE.EXE
1684 IEXPLORE.EXE

description	pid	process
Token: SeDebugPrivilege	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe

pid	process
2008	iexplore.exe

pid	process
2008	iexplore.exe
2008	iexplore.exe
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exesvchost.exeiexplore.exe

description	pid	process	target process
PID 1396 wrote to memory of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe
PID 1396 wrote to memory of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe
PID 1396 wrote to memory of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe
PID 1396 wrote to memory of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe
PID 1396 wrote to memory of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe
PID 1396 wrote to memory of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe
PID 1396 wrote to memory of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe
PID 1396 wrote to memory of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe
PID 1396 wrote to memory of 276	1396	b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe	svchost.exe
PID 276 wrote to memory of 2008	276	svchost.exe	iexplore.exe
PID 276 wrote to memory of 2008	276	svchost.exe	iexplore.exe
PID 276 wrote to memory of 2008	276	svchost.exe	iexplore.exe
PID 276 wrote to memory of 2008	276	svchost.exe	iexplore.exe
PID 2008 wrote to memory of 1684	2008	iexplore.exe	IEXPLORE.EXE
PID 2008 wrote to memory of 1684	2008	iexplore.exe	IEXPLORE.EXE
PID 2008 wrote to memory of 1684	2008	iexplore.exe	IEXPLORE.EXE
PID 2008 wrote to memory of 1684	2008	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe
"C:\Users\Admin\AppData\Local\Temp\b88e59a671c867f267518f0deb3ed811db8e0ffb28d686e607f21750c63a5d8d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\svchost.exe
"\Windows\System32\svchost.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:276

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MV31TML1.txt
Filesize
608B

MD5
11657c3c8e7d262660265b04c069c8e8

SHA1
476d1e93c198f6aee9b5e2e289749dcd9b55e5eb

SHA256
6ee27b941ce4dd522dc649d37cfb9634e5acaf5fd4e349cb3e3efc0b9aac627b

SHA512
dab5ba4d4b0ac75dceab24da370572b4dfad23f4d6d2c6aa679991e502b8358eb9465ef28e8824487c41830218df3766600c9ccc12b3585c5496a90dc5fcd17c

Download Submit
memory/276-61-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/276-57-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/276-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/276-60-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/276-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/276-63-0x000000000040749E-mapping.dmp

Download
memory/276-65-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/276-67-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1396-56-0x0000000074720000-0x0000000074CCB000-memory.dmp

Filesize
5.7MB

Download
memory/1396-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/1396-68-0x0000000074720000-0x0000000074CCB000-memory.dmp

Filesize
5.7MB

Download
memory/1396-55-0x0000000074720000-0x0000000074CCB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads