njrat | f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

General

Target

f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
Size

228KB
MD5

83b10470cef172aef511a30d31c668aa
SHA1

c5cb4ca62712f8c9f51c14a08d92b2d6706a0892
SHA256

f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23
SHA512

465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918
SSDEEP

3072:hnK4i05Pdj0OfV3BpR9m4PzSQkeeAaF+I7xrXlPb3+HUHFiVeui:Bi055l/g4bOAART+HUHFi+

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
1752	taskmgr.exe
588	taskmgr.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1204	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\927023f818e6ce8ef3ccb347194b0a7e.exe	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\927023f818e6ce8ef3ccb347194b0a7e.exe	taskmgr.exe

Loads dropped DLL 3 IoCs

pid	Process
1352	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
1352	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
1752	taskmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\927023f818e6ce8ef3ccb347194b0a7e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\927023f818e6ce8ef3ccb347194b0a7e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1504 set thread context of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1752 set thread context of 588	1752	taskmgr.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
1752	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe
588	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
Token: SeDebugPrivilege	1752	taskmgr.exe
Token: SeDebugPrivilege	588	taskmgr.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1504 wrote to memory of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1504 wrote to memory of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1504 wrote to memory of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1504 wrote to memory of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1504 wrote to memory of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1504 wrote to memory of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1504 wrote to memory of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1504 wrote to memory of 1352	1504	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	26
PID 1352 wrote to memory of 1752	1352	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	27
PID 1352 wrote to memory of 1752	1352	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	27
PID 1352 wrote to memory of 1752	1352	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	27
PID 1352 wrote to memory of 1752	1352	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	27
PID 1752 wrote to memory of 588	1752	taskmgr.exe	28
PID 1752 wrote to memory of 588	1752	taskmgr.exe	28
PID 1752 wrote to memory of 588	1752	taskmgr.exe	28
PID 1752 wrote to memory of 588	1752	taskmgr.exe	28
PID 1752 wrote to memory of 588	1752	taskmgr.exe	28
PID 1752 wrote to memory of 588	1752	taskmgr.exe	28
PID 1752 wrote to memory of 588	1752	taskmgr.exe	28
PID 1752 wrote to memory of 588	1752	taskmgr.exe	28
PID 1752 wrote to memory of 588	1752	taskmgr.exe	28
PID 588 wrote to memory of 1204	588	taskmgr.exe	29
PID 588 wrote to memory of 1204	588	taskmgr.exe	29
PID 588 wrote to memory of 1204	588	taskmgr.exe	29
PID 588 wrote to memory of 1204	588	taskmgr.exe	29

C:\Users\Admin\AppData\Local\Temp\f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
"C:\Users\Admin\AppData\Local\Temp\f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
  f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
    "C:\Users\Admin\AppData\Local\Temp\taskmgr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
      taskmgr
      4⤵
      Executes dropped EXE
      Drops startup file
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:588
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskmgr.exe" "taskmgr.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:1204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
228KB

MD5
83b10470cef172aef511a30d31c668aa

SHA1
c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

SHA256
f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

SHA512
465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
228KB

MD5
83b10470cef172aef511a30d31c668aa

SHA1
c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

SHA256
f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

SHA512
465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
228KB

MD5
83b10470cef172aef511a30d31c668aa

SHA1
c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

SHA256
f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

SHA512
465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

Download Submit
\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
228KB

MD5
83b10470cef172aef511a30d31c668aa

SHA1
c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

SHA256
f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

SHA512
465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

Download Submit
\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
228KB

MD5
83b10470cef172aef511a30d31c668aa

SHA1
c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

SHA256
f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

SHA512
465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

Download Submit
\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
228KB

MD5
83b10470cef172aef511a30d31c668aa

SHA1
c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

SHA256
f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

SHA512
465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

Download Submit
memory/588-86-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/588-84-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1352-61-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1352-64-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1352-71-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1352-59-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1352-56-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1504-63-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1752-72-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1752-80-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing