njrat | ae88b4f33250bff23d4f922e0a2939140641e9842584bbca1ebfa8b0ba62d7af

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
15/10/2022, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a2b4ca9090f8ae9f69d99466376f108.exe
Size

37KB
MD5

0a2b4ca9090f8ae9f69d99466376f108
SHA1

36e66aec5aa6b23c4139352aedcda41fa59272e5
SHA256

ae88b4f33250bff23d4f922e0a2939140641e9842584bbca1ebfa8b0ba62d7af
SHA512

5b1e2c09348142e3c5cd41c6e64b28767104ccc5d9f1086b669e2306598dbb3cc149987ad04e6cc318aa53478274ff14d938eef97bfc99f3bc1770711b13af16
SSDEEP

384:pAy3hUidkgXR21cGMy8PCVARPj4FltsItArAF+rMRTyN/0L+EcoinblneHQM3epV:6y3fLGv8PCVARUdsI6rM+rMRa8Nuswt

Score

10^/10

njrat mixa lox evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

mixa lox

4.tcp.eu.ngrok.io:15409

Mutex

2244d96886d7942f8f3ff97ff86f4468

Attributes

reg_key
2244d96886d7942f8f3ff97ff86f4468
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
2008	svchost.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1112	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2244d96886d7942f8f3ff97ff86f4468.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2244d96886d7942f8f3ff97ff86f4468.exe	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1200	0a2b4ca9090f8ae9f69d99466376f108.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2244d96886d7942f8f3ff97ff86f4468 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\2244d96886d7942f8f3ff97ff86f4468 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe
2008	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2008	svchost.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	svchost.exe
Token: 33	2008	svchost.exe
Token: SeIncBasePriorityPrivilege	2008	svchost.exe
Token: 33	2008	svchost.exe
Token: SeIncBasePriorityPrivilege	2008	svchost.exe
Token: 33	2008	svchost.exe
Token: SeIncBasePriorityPrivilege	2008	svchost.exe
Token: 33	2008	svchost.exe
Token: SeIncBasePriorityPrivilege	2008	svchost.exe
Token: 33	2008	svchost.exe
Token: SeIncBasePriorityPrivilege	2008	svchost.exe
Token: 33	2008	svchost.exe
Token: SeIncBasePriorityPrivilege	2008	svchost.exe
Token: 33	2008	svchost.exe
Token: SeIncBasePriorityPrivilege	2008	svchost.exe
Token: 33	2008	svchost.exe
Token: SeIncBasePriorityPrivilege	2008	svchost.exe
Token: 33	2008	svchost.exe
Token: SeIncBasePriorityPrivilege	2008	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2008	1200	0a2b4ca9090f8ae9f69d99466376f108.exe	27
PID 1200 wrote to memory of 2008	1200	0a2b4ca9090f8ae9f69d99466376f108.exe	27
PID 1200 wrote to memory of 2008	1200	0a2b4ca9090f8ae9f69d99466376f108.exe	27
PID 1200 wrote to memory of 2008	1200	0a2b4ca9090f8ae9f69d99466376f108.exe	27
PID 2008 wrote to memory of 1112	2008	svchost.exe	28
PID 2008 wrote to memory of 1112	2008	svchost.exe	28
PID 2008 wrote to memory of 1112	2008	svchost.exe	28
PID 2008 wrote to memory of 1112	2008	svchost.exe	28

C:\Users\Admin\AppData\Local\Temp\0a2b4ca9090f8ae9f69d99466376f108.exe
"C:\Users\Admin\AppData\Local\Temp\0a2b4ca9090f8ae9f69d99466376f108.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
37KB

MD5
0a2b4ca9090f8ae9f69d99466376f108

SHA1
36e66aec5aa6b23c4139352aedcda41fa59272e5

SHA256
ae88b4f33250bff23d4f922e0a2939140641e9842584bbca1ebfa8b0ba62d7af

SHA512
5b1e2c09348142e3c5cd41c6e64b28767104ccc5d9f1086b669e2306598dbb3cc149987ad04e6cc318aa53478274ff14d938eef97bfc99f3bc1770711b13af16

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
37KB

MD5
0a2b4ca9090f8ae9f69d99466376f108

SHA1
36e66aec5aa6b23c4139352aedcda41fa59272e5

SHA256
ae88b4f33250bff23d4f922e0a2939140641e9842584bbca1ebfa8b0ba62d7af

SHA512
5b1e2c09348142e3c5cd41c6e64b28767104ccc5d9f1086b669e2306598dbb3cc149987ad04e6cc318aa53478274ff14d938eef97bfc99f3bc1770711b13af16

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
37KB

MD5
0a2b4ca9090f8ae9f69d99466376f108

SHA1
36e66aec5aa6b23c4139352aedcda41fa59272e5

SHA256
ae88b4f33250bff23d4f922e0a2939140641e9842584bbca1ebfa8b0ba62d7af

SHA512
5b1e2c09348142e3c5cd41c6e64b28767104ccc5d9f1086b669e2306598dbb3cc149987ad04e6cc318aa53478274ff14d938eef97bfc99f3bc1770711b13af16

Download Submit
memory/1200-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1200-55-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/1200-61-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2008-62-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2008-65-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download