Overview

overview

10

Static

static

10

1976-55-0x...ry.exe

windows7-x64

10

1976-55-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1976-55-0x0000000000140000-0x000000000014E000-memory.dmp

  • Size

    56KB

  • Sample

    221010-1venlsdegp

  • MD5

    cd0043fc54000e1f3df815ae1a06ffa8

  • SHA1

    0fc0419af51b525c8b2fa6cfadd2f8cdca508309

  • SHA256

    47d7803f61b02e9f7f3407ba859c7cedc13940f5d7b8fd4206080a514e4f96f2

  • SHA512

    42ae0217f8c4e13c9b4818fedbd3179d63680f10a3b8b8016adf40ab950214f5c7a8e515e2c38c422287c545b93d80823457df0c9b4479c7c6fa491ea499ae99

  • SSDEEP

    384:oLtRVub+AUbJrCXgfu6ZQPK2m0M5AQk93vmhm7UMKmIEecKdbXTzm9bVhcaq6kre:W/NS8F5A/vMHTi9bD

Score
10/10
njrat2023persistencetrojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

2023

C2

muhammed1.ddns.net:1177

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      1976-55-0x0000000000140000-0x000000000014E000-memory.dmp

    • Size

      56KB

    • MD5

      cd0043fc54000e1f3df815ae1a06ffa8

    • SHA1

      0fc0419af51b525c8b2fa6cfadd2f8cdca508309

    • SHA256

      47d7803f61b02e9f7f3407ba859c7cedc13940f5d7b8fd4206080a514e4f96f2

    • SHA512

      42ae0217f8c4e13c9b4818fedbd3179d63680f10a3b8b8016adf40ab950214f5c7a8e515e2c38c422287c545b93d80823457df0c9b4479c7c6fa491ea499ae99

    • SSDEEP

      384:oLtRVub+AUbJrCXgfu6ZQPK2m0M5AQk93vmhm7UMKmIEecKdbXTzm9bVhcaq6kre:W/NS8F5A/vMHTi9bD

    Score
    10/10
    njrat2023persistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks