njrat | 4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab

Analysis

max time kernel
154s
max time network
163s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
14-10-2022 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exe
Size

46KB
MD5

3e361edc828ebc551573d3e28be3b295
SHA1

130f4c5de25056add49babfdb2593727b9983b80
SHA256

4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab
SHA512

0559d0f8ca7f860e301d265d63cef5f67a5c7a92e0fa99cecaf92a97f3780110fcebab7f8272505933517fb135142d54b3c113955d53b66be8e3188a769a5a73
SSDEEP

384:FEnraio1n7S5pbpQyEfhqH0f3IYykxarAF+rMRTyN/0L+EcoinblneHQM3epzXpM:SnT3pLEfgH0AlkYrM+rMRa8NuiUtBA

Score

10^/10

njrat haxpc evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HAXPC

enderop44-36084.portmap.host:36084

Mutex

3d331bcce43ca74aba3fe5b393e79935

Attributes

reg_key
3d331bcce43ca74aba3fe5b393e79935
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

WinExplorer.exe

pid process

4780 WinExplorer.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

3812 netsh.exe

pid	process
3812	netsh.exe

Drops startup file 2 IoCs

Processes:

WinExplorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3d331bcce43ca74aba3fe5b393e79935.exe	WinExplorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3d331bcce43ca74aba3fe5b393e79935.exe	WinExplorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WinExplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\3d331bcce43ca74aba3fe5b393e79935 = "\"C:\\Windows\\WinExplorer.exe\" .."	WinExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3d331bcce43ca74aba3fe5b393e79935 = "\"C:\\Windows\\WinExplorer.exe\" .."	WinExplorer.exe

Drops file in Windows directory 3 IoCs

Processes:

WinExplorer.exe4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exe

description	ioc	process
File opened for modification	C:\Windows\WinExplorer.exe	WinExplorer.exe
File created	C:\Windows\WinExplorer.exe	4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exe
File opened for modification	C:\Windows\WinExplorer.exe	4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WinExplorer.exe

pid	process
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe
4780	WinExplorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WinExplorer.exe

pid process

4780 WinExplorer.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

WinExplorer.exe

description	pid	process
Token: SeDebugPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe
Token: 33	4780	WinExplorer.exe
Token: SeIncBasePriorityPrivilege	4780	WinExplorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exeWinExplorer.exe

description	pid	process	target process
PID 2636 wrote to memory of 4780	2636	4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exe	WinExplorer.exe
PID 2636 wrote to memory of 4780	2636	4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exe	WinExplorer.exe
PID 2636 wrote to memory of 4780	2636	4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exe	WinExplorer.exe
PID 4780 wrote to memory of 3812	4780	WinExplorer.exe	netsh.exe
PID 4780 wrote to memory of 3812	4780	WinExplorer.exe	netsh.exe
PID 4780 wrote to memory of 3812	4780	WinExplorer.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exe
"C:\Users\Admin\AppData\Local\Temp\4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\WinExplorer.exe
"C:\Windows\WinExplorer.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Windows\WinExplorer.exe" "WinExplorer.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:3812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\WinExplorer.exe
Filesize
46KB

MD5
3e361edc828ebc551573d3e28be3b295

SHA1
130f4c5de25056add49babfdb2593727b9983b80

SHA256
4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab

SHA512
0559d0f8ca7f860e301d265d63cef5f67a5c7a92e0fa99cecaf92a97f3780110fcebab7f8272505933517fb135142d54b3c113955d53b66be8e3188a769a5a73

Download Submit
C:\Windows\WinExplorer.exe
Filesize
46KB

MD5
3e361edc828ebc551573d3e28be3b295

SHA1
130f4c5de25056add49babfdb2593727b9983b80

SHA256
4c0abcb1e8d0205bce6f78dfc47bdc65f5e9f27e4279547fc1149c17b4fbc3ab

SHA512
0559d0f8ca7f860e301d265d63cef5f67a5c7a92e0fa99cecaf92a97f3780110fcebab7f8272505933517fb135142d54b3c113955d53b66be8e3188a769a5a73

Download Submit
memory/2636-118-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-119-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-120-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-121-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-122-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-123-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-124-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-125-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-126-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-127-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-128-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-129-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-130-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-131-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-132-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-133-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-134-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-135-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-136-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-137-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-139-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-138-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-141-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-140-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-142-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-143-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-144-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-145-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-146-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-147-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-148-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-149-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-150-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-151-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-152-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-154-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-153-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-155-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-156-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-157-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-158-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-159-0x0000000073A50000-0x0000000074000000-memory.dmp

Filesize
5.7MB

Download
memory/2636-160-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-161-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-162-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-163-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-164-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-165-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-166-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-167-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-168-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-169-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-170-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-171-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-172-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/2636-179-0x0000000073A50000-0x0000000074000000-memory.dmp

Filesize
5.7MB

Download
memory/3812-222-0x0000000000000000-mapping.dmp

Download
memory/4780-173-0x0000000000000000-mapping.dmp

Download
memory/4780-175-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-176-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-177-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-178-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-180-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-181-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-182-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-183-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-185-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-186-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4780-221-0x0000000073A50000-0x0000000074000000-memory.dmp

Filesize
5.7MB

Download
memory/4780-419-0x0000000073A50000-0x0000000074000000-memory.dmp

Filesize
5.7MB

Download