njrat | bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77

General

Target

bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Size

481KB
MD5

27e00b93a37c51f428df323ea212c120
SHA1

f2a35453203bd6352e63e8f11b73a141c2e7bcff
SHA256

bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77
SHA512

991a1d3c04bdf76a62df8917577df8487503b7e60a9e764fd4da414ef6820feae35caf43cfbbd98a2a493848afed5968d05e251ac66ecb585df7dfe32580ed43
SSDEEP

6144:+4ZXzlxRdFf8SOcHeBl1b3HflUgxwTcDzw2:+sxLFfFOcHK1bvlUgxwd

Score

10^/10

njrat top evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

TOP

C2

127.0.0.1:1177

Mutex

1daaeb58fdbc3f56c70815de2de95e46

Attributes

reg_key
1daaeb58fdbc3f56c70815de2de95e46
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

Chrome.exeChrome.exe

pid process

1864 Chrome.exe
1872 Chrome.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2440 netsh.exe

pid	process
1864	Chrome.exe
1872	Chrome.exe

pid	process
2440	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe

Drops startup file 2 IoCs

Processes:

Chrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1daaeb58fdbc3f56c70815de2de95e46.exe	Chrome.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1daaeb58fdbc3f56c70815de2de95e46.exe	Chrome.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Chrome.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1daaeb58fdbc3f56c70815de2de95e46 = "\"C:\\Users\\Admin\\Chrome.exe\" .."	Chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1daaeb58fdbc3f56c70815de2de95e46 = "\"C:\\Users\\Admin\\Chrome.exe\" .."	Chrome.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exeChrome.exe

description	pid	process	target process
PID 3304 set thread context of 4964	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
PID 1864 set thread context of 1872	1864	Chrome.exe	Chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exeChrome.exeChrome.exe

description	pid	process
Token: SeDebugPrivilege	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Token: 33	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Token: SeIncBasePriorityPrivilege	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Token: 33	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Token: SeIncBasePriorityPrivilege	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Token: 33	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Token: SeIncBasePriorityPrivilege	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
Token: SeDebugPrivilege	1864	Chrome.exe
Token: 33	1864	Chrome.exe
Token: SeIncBasePriorityPrivilege	1864	Chrome.exe
Token: SeDebugPrivilege	1872	Chrome.exe
Token: 33	1872	Chrome.exe
Token: SeIncBasePriorityPrivilege	1872	Chrome.exe
Token: 33	1872	Chrome.exe
Token: SeIncBasePriorityPrivilege	1872	Chrome.exe
Token: 33	1872	Chrome.exe
Token: SeIncBasePriorityPrivilege	1872	Chrome.exe
Token: 33	1872	Chrome.exe
Token: SeIncBasePriorityPrivilege	1872	Chrome.exe
Token: 33	1872	Chrome.exe
Token: SeIncBasePriorityPrivilege	1872	Chrome.exe
Token: 33	1872	Chrome.exe
Token: SeIncBasePriorityPrivilege	1872	Chrome.exe
Token: 33	1872	Chrome.exe
Token: SeIncBasePriorityPrivilege	1872	Chrome.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exebf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exeChrome.exeChrome.exe

description	pid	process	target process
PID 3304 wrote to memory of 4964	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
PID 3304 wrote to memory of 4964	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
PID 3304 wrote to memory of 4964	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
PID 3304 wrote to memory of 4964	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
PID 3304 wrote to memory of 4964	3304	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
PID 4964 wrote to memory of 1864	4964	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe	Chrome.exe
PID 4964 wrote to memory of 1864	4964	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe	Chrome.exe
PID 4964 wrote to memory of 1864	4964	bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe	Chrome.exe
PID 1864 wrote to memory of 1872	1864	Chrome.exe	Chrome.exe
PID 1864 wrote to memory of 1872	1864	Chrome.exe	Chrome.exe
PID 1864 wrote to memory of 1872	1864	Chrome.exe	Chrome.exe
PID 1864 wrote to memory of 1872	1864	Chrome.exe	Chrome.exe
PID 1864 wrote to memory of 1872	1864	Chrome.exe	Chrome.exe
PID 1872 wrote to memory of 2440	1872	Chrome.exe	netsh.exe
PID 1872 wrote to memory of 2440	1872	Chrome.exe	netsh.exe
PID 1872 wrote to memory of 2440	1872	Chrome.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
"C:\Users\Admin\AppData\Local\Temp\bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304

C:\Users\Admin\AppData\Local\Temp\bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
C:\Users\Admin\AppData\Local\Temp\bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\Chrome.exe
"C:\Users\Admin\Chrome.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\Chrome.exe
C:\Users\Admin\Chrome.exe
4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\Chrome.exe" "Chrome.exe" ENABLE
5⤵
- Modifies Windows Firewall
PID:2440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77.exe.log
Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
C:\Users\Admin\Chrome.exe
Filesize
481KB

MD5
27e00b93a37c51f428df323ea212c120

SHA1
f2a35453203bd6352e63e8f11b73a141c2e7bcff

SHA256
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77

SHA512
991a1d3c04bdf76a62df8917577df8487503b7e60a9e764fd4da414ef6820feae35caf43cfbbd98a2a493848afed5968d05e251ac66ecb585df7dfe32580ed43

Download Submit
C:\Users\Admin\Chrome.exe
Filesize
481KB

MD5
27e00b93a37c51f428df323ea212c120

SHA1
f2a35453203bd6352e63e8f11b73a141c2e7bcff

SHA256
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77

SHA512
991a1d3c04bdf76a62df8917577df8487503b7e60a9e764fd4da414ef6820feae35caf43cfbbd98a2a493848afed5968d05e251ac66ecb585df7dfe32580ed43

Download Submit
C:\Users\Admin\Chrome.exe
Filesize
481KB

MD5
27e00b93a37c51f428df323ea212c120

SHA1
f2a35453203bd6352e63e8f11b73a141c2e7bcff

SHA256
bf1395855f7fbcac2955ca12b178e53726385eec04600d1efe9d40cc4b64ef77

SHA512
991a1d3c04bdf76a62df8917577df8487503b7e60a9e764fd4da414ef6820feae35caf43cfbbd98a2a493848afed5968d05e251ac66ecb585df7dfe32580ed43

Download Submit
memory/1864-139-0x0000000000000000-mapping.dmp

Download
memory/1872-143-0x0000000000000000-mapping.dmp

Download
memory/2440-146-0x0000000000000000-mapping.dmp

Download
memory/3304-135-0x0000000004D80000-0x0000000004E1C000-memory.dmp

Filesize
624KB

Download
memory/3304-136-0x0000000005070000-0x000000000507A000-memory.dmp

Filesize
40KB

Download
memory/3304-132-0x0000000000260000-0x00000000002DE000-memory.dmp

Filesize
504KB

Download
memory/3304-134-0x0000000004CE0000-0x0000000004D72000-memory.dmp

Filesize
584KB

Download
memory/3304-133-0x0000000005290000-0x0000000005834000-memory.dmp

Filesize
5.6MB

Download
memory/4964-137-0x0000000000000000-mapping.dmp

Download
memory/4964-138-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads