njrat | aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700

Analysis

max time kernel
37s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe
Size

23KB
MD5

dce35b0e4769409b8ec1564a216d208d
SHA1

48f8fc9599cc8ae6671099e84e5e8b2ff8af5b3d
SHA256

aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700
SHA512

66b557e11ef9e1cd837d1e8876f0efdc2a8674a5ed8e37c0bcceb5de78f16f6253493afc81cc213aac23f2a36b936e78359065c603e01abd6594623216c22206
SSDEEP

384:dMQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZzS:FOaxVULRpcnuh

Score

10^/10

njrat facebook trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

facebook

webhosting.no-ip.biz:1177

Mutex

f80c58c81bb54cc02a5aa1df65019452

Attributes

reg_key
f80c58c81bb54cc02a5aa1df65019452
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

win32.exe

pid process

432 win32.exe
Loads dropped DLL 1 IoCs

Processes:

aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe

pid process

1172 aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
432	win32.exe

pid	process
1172	aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe

description	pid	process	target process
PID 1172 wrote to memory of 432	1172	aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe	win32.exe
PID 1172 wrote to memory of 432	1172	aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe	win32.exe
PID 1172 wrote to memory of 432	1172	aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe	win32.exe
PID 1172 wrote to memory of 432	1172	aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe	win32.exe

C:\Users\Admin\AppData\Local\Temp\aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe
"C:\Users\Admin\AppData\Local\Temp\aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1172

C:\Users\Admin\win32.exe
"C:\Users\Admin\win32.exe"
2⤵
- Executes dropped EXE
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\win32.exe
Filesize
23KB

MD5
dce35b0e4769409b8ec1564a216d208d

SHA1
48f8fc9599cc8ae6671099e84e5e8b2ff8af5b3d

SHA256
aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700

SHA512
66b557e11ef9e1cd837d1e8876f0efdc2a8674a5ed8e37c0bcceb5de78f16f6253493afc81cc213aac23f2a36b936e78359065c603e01abd6594623216c22206

Download Submit
C:\Users\Admin\win32.exe
Filesize
23KB

MD5
dce35b0e4769409b8ec1564a216d208d

SHA1
48f8fc9599cc8ae6671099e84e5e8b2ff8af5b3d

SHA256
aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700

SHA512
66b557e11ef9e1cd837d1e8876f0efdc2a8674a5ed8e37c0bcceb5de78f16f6253493afc81cc213aac23f2a36b936e78359065c603e01abd6594623216c22206

Download Submit
\Users\Admin\win32.exe
Filesize
23KB

MD5
dce35b0e4769409b8ec1564a216d208d

SHA1
48f8fc9599cc8ae6671099e84e5e8b2ff8af5b3d

SHA256
aeadaa52c390eb0d261e7452e4136fd917e347a9ffd8eee0f71d0b0a5fff3700

SHA512
66b557e11ef9e1cd837d1e8876f0efdc2a8674a5ed8e37c0bcceb5de78f16f6253493afc81cc213aac23f2a36b936e78359065c603e01abd6594623216c22206

Download Submit
memory/432-58-0x0000000000000000-mapping.dmp

Download
memory/432-62-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/432-63-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/1172-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1172-55-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/1172-56-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/1172-64-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download