njrat | 69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b

General

Target

69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe
Size

636KB
MD5

2880dc879adb28c27134757124c80c70
SHA1

5ee6c7f6081f49699c5343d70ba26dacf2e95fa4
SHA256

69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b
SHA512

687d806178bc3b02c7e516408b4383aa32e5d751d734bbaad285e3f148b1fcdb09a2f52a3da63acd3ceef9f582e41603e62f59ac1128d0f1763d8e40e8b02382
SSDEEP

12288:UvwZHcnHDco5+dYJJo3DqDUgvJtkw0zUE5WhMOqOTAw2mIxKnL48+GHGBv:2wZHcnHDxdLlxml

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

muamal33.no-ip.biz:5552

Mutex

d1b7976cc03cc428bbc29dcfb39b895f

Attributes

reg_key
d1b7976cc03cc428bbc29dcfb39b895f
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
4824	google.exe
4888	google.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
316	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d1b7976cc03cc428bbc29dcfb39b895f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .."	google.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\d1b7976cc03cc428bbc29dcfb39b895f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .."	google.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1056 set thread context of 5048	1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe	82
PID 4824 set thread context of 4888	4824	google.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe
1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe
1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe
4824	google.exe
4824	google.exe
4824	google.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe
Token: SeDebugPrivilege	4824	google.exe
Token: SeDebugPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe
Token: 33	4888	google.exe
Token: SeIncBasePriorityPrivilege	4888	google.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 5048	1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe	82
PID 1056 wrote to memory of 5048	1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe	82
PID 1056 wrote to memory of 5048	1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe	82
PID 1056 wrote to memory of 5048	1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe	82
PID 1056 wrote to memory of 5048	1056	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe	82
PID 5048 wrote to memory of 4824	5048	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe	84
PID 5048 wrote to memory of 4824	5048	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe	84
PID 5048 wrote to memory of 4824	5048	69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe	84
PID 4824 wrote to memory of 4888	4824	google.exe	85
PID 4824 wrote to memory of 4888	4824	google.exe	85
PID 4824 wrote to memory of 4888	4824	google.exe	85
PID 4824 wrote to memory of 4888	4824	google.exe	85
PID 4824 wrote to memory of 4888	4824	google.exe	85
PID 4888 wrote to memory of 316	4888	google.exe	86
PID 4888 wrote to memory of 316	4888	google.exe	86
PID 4888 wrote to memory of 316	4888	google.exe	86

C:\Users\Admin\AppData\Local\Temp\69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe
"C:\Users\Admin\AppData\Local\Temp\69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe
  C:\Users\Admin\AppData\Local\Temp\69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\google.exe
    "C:\Users\Admin\AppData\Local\Temp\google.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\google.exe
      C:\Users\Admin\AppData\Local\Temp\google.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\google.exe" "google.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b.exe.log

Filesize
1KB

MD5
a5813b2fbedad197cb1ea1095ea20345

SHA1
6df7a07e630007745eab18403bbb5aefb108bbaa

SHA256
292b643e127d04b0c248cd8a076b870ee330e7bb6f46c058ddefc65e2c324c22

SHA512
4cd0ee826f2b2e8eb7b66f25f5089bf7e125b56e4c71425578784f5f306b574ad980748fa99d54b6158dddf3a8d0ba4c6049af563843bd76e2231e259161e4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\google.exe

Filesize
636KB

MD5
2880dc879adb28c27134757124c80c70

SHA1
5ee6c7f6081f49699c5343d70ba26dacf2e95fa4

SHA256
69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b

SHA512
687d806178bc3b02c7e516408b4383aa32e5d751d734bbaad285e3f148b1fcdb09a2f52a3da63acd3ceef9f582e41603e62f59ac1128d0f1763d8e40e8b02382

Download Submit
C:\Users\Admin\AppData\Local\Temp\google.exe

Filesize
636KB

MD5
2880dc879adb28c27134757124c80c70

SHA1
5ee6c7f6081f49699c5343d70ba26dacf2e95fa4

SHA256
69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b

SHA512
687d806178bc3b02c7e516408b4383aa32e5d751d734bbaad285e3f148b1fcdb09a2f52a3da63acd3ceef9f582e41603e62f59ac1128d0f1763d8e40e8b02382

Download Submit
C:\Users\Admin\AppData\Local\Temp\google.exe

Filesize
636KB

MD5
2880dc879adb28c27134757124c80c70

SHA1
5ee6c7f6081f49699c5343d70ba26dacf2e95fa4

SHA256
69f5dadcba43c8ce8469aeb43666cc1c46981b59986e4b9a0c30cc03c08eec1b

SHA512
687d806178bc3b02c7e516408b4383aa32e5d751d734bbaad285e3f148b1fcdb09a2f52a3da63acd3ceef9f582e41603e62f59ac1128d0f1763d8e40e8b02382

Download Submit
memory/316-147-0x0000000000000000-mapping.dmp

Download
memory/1056-135-0x0000000004E70000-0x0000000004E7A000-memory.dmp

Filesize
40KB

Download
memory/1056-137-0x0000000007460000-0x00000000074FC000-memory.dmp

Filesize
624KB

Download
memory/1056-136-0x00000000051B0000-0x000000000527E000-memory.dmp

Filesize
824KB

Download
memory/1056-132-0x0000000000410000-0x00000000004B6000-memory.dmp

Filesize
664KB

Download
memory/1056-134-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Filesize
584KB

Download
memory/1056-133-0x00000000055A0000-0x0000000005B44000-memory.dmp

Filesize
5.6MB

Download
memory/4824-140-0x0000000000000000-mapping.dmp

Download
memory/4888-144-0x0000000000000000-mapping.dmp

Download
memory/5048-138-0x0000000000000000-mapping.dmp

Download
memory/5048-139-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing