njrat | f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

General

Target

f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
Size

228KB
MD5

83b10470cef172aef511a30d31c668aa
SHA1

c5cb4ca62712f8c9f51c14a08d92b2d6706a0892
SHA256

f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23
SHA512

465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918
SSDEEP

3072:hnK4i05Pdj0OfV3BpR9m4PzSQkeeAaF+I7xrXlPb3+HUHFiVeui:Bi055l/g4bOAART+HUHFi+

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
3556	taskmgr.exe
3468	taskmgr.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2896	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\927023f818e6ce8ef3ccb347194b0a7e.exe	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\927023f818e6ce8ef3ccb347194b0a7e.exe	taskmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\927023f818e6ce8ef3ccb347194b0a7e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\927023f818e6ce8ef3ccb347194b0a7e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 4732	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	83
PID 3556 set thread context of 3468	3556	taskmgr.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
3556	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe
3468	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
Token: SeDebugPrivilege	3556	taskmgr.exe
Token: SeDebugPrivilege	3468	taskmgr.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 4732	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	83
PID 1956 wrote to memory of 4732	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	83
PID 1956 wrote to memory of 4732	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	83
PID 1956 wrote to memory of 4732	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	83
PID 1956 wrote to memory of 4732	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	83
PID 1956 wrote to memory of 4732	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	83
PID 1956 wrote to memory of 4732	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	83
PID 1956 wrote to memory of 4732	1956	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	83
PID 4732 wrote to memory of 3556	4732	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	84
PID 4732 wrote to memory of 3556	4732	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	84
PID 4732 wrote to memory of 3556	4732	f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe	84
PID 3556 wrote to memory of 3468	3556	taskmgr.exe	85
PID 3556 wrote to memory of 3468	3556	taskmgr.exe	85
PID 3556 wrote to memory of 3468	3556	taskmgr.exe	85
PID 3556 wrote to memory of 3468	3556	taskmgr.exe	85
PID 3556 wrote to memory of 3468	3556	taskmgr.exe	85
PID 3556 wrote to memory of 3468	3556	taskmgr.exe	85
PID 3556 wrote to memory of 3468	3556	taskmgr.exe	85
PID 3556 wrote to memory of 3468	3556	taskmgr.exe	85
PID 3468 wrote to memory of 2896	3468	taskmgr.exe	86
PID 3468 wrote to memory of 2896	3468	taskmgr.exe	86
PID 3468 wrote to memory of 2896	3468	taskmgr.exe	86

C:\Users\Admin\AppData\Local\Temp\f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
"C:\Users\Admin\AppData\Local\Temp\f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe
  f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
    "C:\Users\Admin\AppData\Local\Temp\taskmgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
      taskmgr
      4⤵
      Executes dropped EXE
      Drops startup file
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskmgr.exe" "taskmgr.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:2896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23.exe.log

Filesize
224B

MD5
c19eb8c8e7a40e6b987f9d2ee952996e

SHA1
6fc3049855bc9100643e162511673c6df0f28bfb

SHA256
677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

SHA512
860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\taskmgr.exe.log

Filesize
224B

MD5
c19eb8c8e7a40e6b987f9d2ee952996e

SHA1
6fc3049855bc9100643e162511673c6df0f28bfb

SHA256
677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

SHA512
860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
228KB

MD5
83b10470cef172aef511a30d31c668aa

SHA1
c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

SHA256
f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

SHA512
465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
228KB

MD5
83b10470cef172aef511a30d31c668aa

SHA1
c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

SHA256
f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

SHA512
465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
228KB

MD5
83b10470cef172aef511a30d31c668aa

SHA1
c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

SHA256
f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

SHA512
465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

Download Submit
memory/1956-132-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/1956-136-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/3468-149-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/3468-148-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/3556-146-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/4732-141-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/4732-134-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4732-135-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing