njrat | 44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd

General

Target

44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe
Size

23KB
MD5

8126a74a7c567d80e2abce8eb3f6eaa0
SHA1

da69d9da5b91914043a80bb7366678e6f1858c77
SHA256

44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd
SHA512

cd1bc9e592aab9ac3f0ab7d789b1a4bf15cb16a6bbb30b967f257de2f40f29f8ea34daf726d33e1c63ca8fab660d5af8b43db133dfe96ca9570b4e016a8318f1
SSDEEP

384:sY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZB7:7L2s+tRyRpcnuq

Score

10^/10

njrat hack evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hack

C2

aymaen.no-ip.biz:1177

Mutex

9ca6239950376da190bd1fc848cacaed

Attributes

reg_key
9ca6239950376da190bd1fc848cacaed
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

vlsr.exe

pid process

1972 vlsr.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1512 netsh.exe
Loads dropped DLL 1 IoCs

Processes:

44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe

pid process

1112 44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe

pid	process
1972	vlsr.exe

pid	process
1512	netsh.exe

pid	process
1112	44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vlsr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\9ca6239950376da190bd1fc848cacaed = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlsr.exe\" .."	vlsr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9ca6239950376da190bd1fc848cacaed = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlsr.exe\" .."	vlsr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

vlsr.exe

description	pid	process
Token: SeDebugPrivilege	1972	vlsr.exe
Token: 33	1972	vlsr.exe
Token: SeIncBasePriorityPrivilege	1972	vlsr.exe
Token: 33	1972	vlsr.exe
Token: SeIncBasePriorityPrivilege	1972	vlsr.exe
Token: 33	1972	vlsr.exe
Token: SeIncBasePriorityPrivilege	1972	vlsr.exe
Token: 33	1972	vlsr.exe
Token: SeIncBasePriorityPrivilege	1972	vlsr.exe
Token: 33	1972	vlsr.exe
Token: SeIncBasePriorityPrivilege	1972	vlsr.exe
Token: 33	1972	vlsr.exe
Token: SeIncBasePriorityPrivilege	1972	vlsr.exe
Token: 33	1972	vlsr.exe
Token: SeIncBasePriorityPrivilege	1972	vlsr.exe
Token: 33	1972	vlsr.exe
Token: SeIncBasePriorityPrivilege	1972	vlsr.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exevlsr.exe

description	pid	process	target process
PID 1112 wrote to memory of 1972	1112	44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe	vlsr.exe
PID 1112 wrote to memory of 1972	1112	44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe	vlsr.exe
PID 1112 wrote to memory of 1972	1112	44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe	vlsr.exe
PID 1112 wrote to memory of 1972	1112	44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe	vlsr.exe
PID 1972 wrote to memory of 1512	1972	vlsr.exe	netsh.exe
PID 1972 wrote to memory of 1512	1972	vlsr.exe	netsh.exe
PID 1972 wrote to memory of 1512	1972	vlsr.exe	netsh.exe
PID 1972 wrote to memory of 1512	1972	vlsr.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe
"C:\Users\Admin\AppData\Local\Temp\44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Local\Temp\vlsr.exe
"C:\Users\Admin\AppData\Local\Temp\vlsr.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\vlsr.exe" "vlsr.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vlsr.exe
Filesize
23KB

MD5
8126a74a7c567d80e2abce8eb3f6eaa0

SHA1
da69d9da5b91914043a80bb7366678e6f1858c77

SHA256
44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd

SHA512
cd1bc9e592aab9ac3f0ab7d789b1a4bf15cb16a6bbb30b967f257de2f40f29f8ea34daf726d33e1c63ca8fab660d5af8b43db133dfe96ca9570b4e016a8318f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlsr.exe
Filesize
23KB

MD5
8126a74a7c567d80e2abce8eb3f6eaa0

SHA1
da69d9da5b91914043a80bb7366678e6f1858c77

SHA256
44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd

SHA512
cd1bc9e592aab9ac3f0ab7d789b1a4bf15cb16a6bbb30b967f257de2f40f29f8ea34daf726d33e1c63ca8fab660d5af8b43db133dfe96ca9570b4e016a8318f1

Download Submit
\Users\Admin\AppData\Local\Temp\vlsr.exe
Filesize
23KB

MD5
8126a74a7c567d80e2abce8eb3f6eaa0

SHA1
da69d9da5b91914043a80bb7366678e6f1858c77

SHA256
44a951e984772c474b3509992d0d549fd5dd1e7bd548099ce5dfcab40554a6bd

SHA512
cd1bc9e592aab9ac3f0ab7d789b1a4bf15cb16a6bbb30b967f257de2f40f29f8ea34daf726d33e1c63ca8fab660d5af8b43db133dfe96ca9570b4e016a8318f1

Download Submit
memory/1112-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1112-56-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1112-62-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1512-64-0x0000000000000000-mapping.dmp

Download
memory/1972-58-0x0000000000000000-mapping.dmp

Download
memory/1972-63-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1972-66-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads