njrat | fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477

General

Target

fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe
Size

22KB
MD5

065150088150b601763bf6eb32529efd
SHA1

5e28035fff3f76c5cb753748006653f88f888cad
SHA256

fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477
SHA512

acaae4845b207be7f319da13d0f95af7ad374a56587ea35e8c4181c47a7e8eb46407b2364104a8a01c8f3dd2e60aaa5eeaf1069fa85df6dfc9c187c7b4d22488
SSDEEP

384:4sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5D8mRvR6JZlbw8hqIusZzZRFz:vf65K2Yf1jlRpcnuU

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

ebo000000.ddns.net:5553

Mutex

a4458faf28727c8f585dd4dc76455384

Attributes

reg_key
a4458faf28727c8f585dd4dc76455384
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

EXR.exe

pid process

548 EXR.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1680 netsh.exe

pid	process
548	EXR.exe

pid	process
1680	netsh.exe

Loads dropped DLL 2 IoCs

Processes:

fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe

pid	process
1624	fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe
1624	fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

EXR.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\a4458faf28727c8f585dd4dc76455384 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EXR.exe\" .."	EXR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\a4458faf28727c8f585dd4dc76455384 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EXR.exe\" .."	EXR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

EXR.exe

description	pid	process
Token: SeDebugPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe
Token: 33	548	EXR.exe
Token: SeIncBasePriorityPrivilege	548	EXR.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exeEXR.exe

description	pid	process	target process
PID 1624 wrote to memory of 548	1624	fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe	EXR.exe
PID 1624 wrote to memory of 548	1624	fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe	EXR.exe
PID 1624 wrote to memory of 548	1624	fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe	EXR.exe
PID 1624 wrote to memory of 548	1624	fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe	EXR.exe
PID 548 wrote to memory of 1680	548	EXR.exe	netsh.exe
PID 548 wrote to memory of 1680	548	EXR.exe	netsh.exe
PID 548 wrote to memory of 1680	548	EXR.exe	netsh.exe
PID 548 wrote to memory of 1680	548	EXR.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe
"C:\Users\Admin\AppData\Local\Temp\fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\EXR.exe
  "C:\Users\Admin\AppData\Local\Temp\EXR.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\EXR.exe" "EXR.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EXR.exe

Filesize
22KB

MD5
065150088150b601763bf6eb32529efd

SHA1
5e28035fff3f76c5cb753748006653f88f888cad

SHA256
fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477

SHA512
acaae4845b207be7f319da13d0f95af7ad374a56587ea35e8c4181c47a7e8eb46407b2364104a8a01c8f3dd2e60aaa5eeaf1069fa85df6dfc9c187c7b4d22488

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXR.exe

Filesize
22KB

MD5
065150088150b601763bf6eb32529efd

SHA1
5e28035fff3f76c5cb753748006653f88f888cad

SHA256
fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477

SHA512
acaae4845b207be7f319da13d0f95af7ad374a56587ea35e8c4181c47a7e8eb46407b2364104a8a01c8f3dd2e60aaa5eeaf1069fa85df6dfc9c187c7b4d22488

Download Submit
\Users\Admin\AppData\Local\Temp\EXR.exe

Filesize
22KB

MD5
065150088150b601763bf6eb32529efd

SHA1
5e28035fff3f76c5cb753748006653f88f888cad

SHA256
fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477

SHA512
acaae4845b207be7f319da13d0f95af7ad374a56587ea35e8c4181c47a7e8eb46407b2364104a8a01c8f3dd2e60aaa5eeaf1069fa85df6dfc9c187c7b4d22488

Download Submit
\Users\Admin\AppData\Local\Temp\EXR.exe

Filesize
22KB

MD5
065150088150b601763bf6eb32529efd

SHA1
5e28035fff3f76c5cb753748006653f88f888cad

SHA256
fff7d5f26c4357c5f731b0174b542b40d48265dac20d387993be6e708950a477

SHA512
acaae4845b207be7f319da13d0f95af7ad374a56587ea35e8c4181c47a7e8eb46407b2364104a8a01c8f3dd2e60aaa5eeaf1069fa85df6dfc9c187c7b4d22488

Download Submit
memory/548-58-0x0000000000000000-mapping.dmp

Download
memory/548-63-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/548-66-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1624-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/1624-55-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1624-62-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/1680-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads