njrat | ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe
Size

29KB
MD5

42bafdfa039f7a0fc54d2cb7ec699ad0
SHA1

1ae11d9e6364f59185662111da19c8888e23d38e
SHA256

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286
SHA512

b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c
SSDEEP

768:KCu75oa4fu124AuhjXeJBKh0p29SgRvU5:O75CPAj8KhG29jv4

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

dmaarr.no.ip.info:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Trojan.exe

pid process

1516 Trojan.exe
Loads dropped DLL 1 IoCs

Processes:

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe

pid process

1968 ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1516	Trojan.exe

pid	process
1968	ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe

description	pid	process	target process
PID 1968 wrote to memory of 1516	1968	ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe	Trojan.exe
PID 1968 wrote to memory of 1516	1968	ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe	Trojan.exe
PID 1968 wrote to memory of 1516	1968	ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe	Trojan.exe
PID 1968 wrote to memory of 1516	1968	ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe	Trojan.exe

C:\Users\Admin\AppData\Local\Temp\ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe
"C:\Users\Admin\AppData\Local\Temp\ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
2⤵
- Executes dropped EXE
PID:1516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
42bafdfa039f7a0fc54d2cb7ec699ad0

SHA1
1ae11d9e6364f59185662111da19c8888e23d38e

SHA256
ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286

SHA512
b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
42bafdfa039f7a0fc54d2cb7ec699ad0

SHA1
1ae11d9e6364f59185662111da19c8888e23d38e

SHA256
ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286

SHA512
b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
42bafdfa039f7a0fc54d2cb7ec699ad0

SHA1
1ae11d9e6364f59185662111da19c8888e23d38e

SHA256
ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286

SHA512
b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c

Download Submit
memory/1516-57-0x0000000000000000-mapping.dmp

Download
memory/1516-60-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1968-54-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/1968-61-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download