njrat | 64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d

General

Target

64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d.exe
Size

23KB
MD5

4b0347abf3500a0c4e1b5b1d1d1dcbb0
SHA1

c1c23c2ae308a1ed151e5fd4f0e6569873b62b99
SHA256

64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d
SHA512

68c0048dc3dde46d0b1ef0e33e5d9d97f338e53d54e31071a96671eb401af4e7f30906dc48bd92ddb5eb796fd0498812c6dbc98bf1c49e5b33e54ce5f2ce00db
SSDEEP

384:PzerxMCQmreJsg/5ZuSppqwpng6tgL29LCBPZVmRvR6JZlbw8hqIusZzZIl:8xq71jBLbRpcnuj

Score

10^/10

njrat ^...^fucked...qassamy^...^evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

^...^Fucked...Qassamy^...^

C2

127.0.0.1:5552

Mutex

6e42abb8e372b1edc80dfa18e2ea207e

Attributes

reg_key
6e42abb8e372b1edc80dfa18e2ea207e
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
228	Windows_03-13 .exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4304	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6e42abb8e372b1edc80dfa18e2ea207e.exe	Windows_03-13 .exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6e42abb8e372b1edc80dfa18e2ea207e.exe	Windows_03-13 .exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe
Token: 33	228	Windows_03-13 .exe
Token: SeIncBasePriorityPrivilege	228	Windows_03-13 .exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 228	364	64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d.exe	80
PID 364 wrote to memory of 228	364	64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d.exe	80
PID 364 wrote to memory of 228	364	64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d.exe	80
PID 228 wrote to memory of 4304	228	Windows_03-13 .exe	82
PID 228 wrote to memory of 4304	228	Windows_03-13 .exe	82
PID 228 wrote to memory of 4304	228	Windows_03-13 .exe	82

C:\Users\Admin\AppData\Local\Temp\64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d.exe
"C:\Users\Admin\AppData\Local\Temp\64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Roaming\Windows_03-13 .exe
  "C:\Users\Admin\AppData\Roaming\Windows_03-13 .exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Windows_03-13 .exe" "Windows_03-13 .exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:4304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windows_03-13 .exe

Filesize
23KB

MD5
4b0347abf3500a0c4e1b5b1d1d1dcbb0

SHA1
c1c23c2ae308a1ed151e5fd4f0e6569873b62b99

SHA256
64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d

SHA512
68c0048dc3dde46d0b1ef0e33e5d9d97f338e53d54e31071a96671eb401af4e7f30906dc48bd92ddb5eb796fd0498812c6dbc98bf1c49e5b33e54ce5f2ce00db

Download Submit
C:\Users\Admin\AppData\Roaming\Windows_03-13 .exe

Filesize
23KB

MD5
4b0347abf3500a0c4e1b5b1d1d1dcbb0

SHA1
c1c23c2ae308a1ed151e5fd4f0e6569873b62b99

SHA256
64d28fcba8b109c63a4ff74ff99894b17d23bd187d54e07029475147237edd1d

SHA512
68c0048dc3dde46d0b1ef0e33e5d9d97f338e53d54e31071a96671eb401af4e7f30906dc48bd92ddb5eb796fd0498812c6dbc98bf1c49e5b33e54ce5f2ce00db

Download Submit
memory/228-138-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/228-140-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/364-132-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/364-133-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/364-137-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing