njrat | ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286

Analysis

max time kernel
184s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe
Size

29KB
MD5

42bafdfa039f7a0fc54d2cb7ec699ad0
SHA1

1ae11d9e6364f59185662111da19c8888e23d38e
SHA256

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286
SHA512

b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c
SSDEEP

768:KCu75oa4fu124AuhjXeJBKh0p29SgRvU5:O75CPAj8KhG29jv4

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

dmaarr.no.ip.info:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Trojan.exe

pid process

1164 Trojan.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

920 netsh.exe

pid	process
920	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

Trojan.exe

pid	process
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe
1164	Trojan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Trojan.exe

description pid process

Token: SeDebugPrivilege 1164 Trojan.exe

description	pid	process
Token: SeDebugPrivilege	1164	Trojan.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exeTrojan.exe

description	pid	process	target process
PID 4208 wrote to memory of 1164	4208	ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe	Trojan.exe
PID 4208 wrote to memory of 1164	4208	ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe	Trojan.exe
PID 4208 wrote to memory of 1164	4208	ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe	Trojan.exe
PID 1164 wrote to memory of 920	1164	Trojan.exe	netsh.exe
PID 1164 wrote to memory of 920	1164	Trojan.exe	netsh.exe
PID 1164 wrote to memory of 920	1164	Trojan.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe
"C:\Users\Admin\AppData\Local\Temp\ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4208

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
42bafdfa039f7a0fc54d2cb7ec699ad0

SHA1
1ae11d9e6364f59185662111da19c8888e23d38e

SHA256
ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286

SHA512
b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
29KB

MD5
42bafdfa039f7a0fc54d2cb7ec699ad0

SHA1
1ae11d9e6364f59185662111da19c8888e23d38e

SHA256
ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286

SHA512
b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c

Download Submit
memory/920-137-0x0000000000000000-mapping.dmp

Download
memory/1164-133-0x0000000000000000-mapping.dmp

Download
memory/1164-138-0x0000000074E30000-0x00000000753E1000-memory.dmp

Filesize
5.7MB

Download
memory/1164-139-0x0000000074E30000-0x00000000753E1000-memory.dmp

Filesize
5.7MB

Download
memory/4208-132-0x0000000074E30000-0x00000000753E1000-memory.dmp

Filesize
5.7MB

Download
memory/4208-136-0x0000000074E30000-0x00000000753E1000-memory.dmp

Filesize
5.7MB

Download