njrat | c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8

General

Target

c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8.exe
Size

23KB
MD5

b666c4da44542080af4e8d10035e3cae
SHA1

4c1df8d41638200ab51d3c22c6d1854b0544a2e2
SHA256

c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8
SHA512

d8a835e5df93056ce193b4aa64bab04bb0c2a008d9385144500e6057d7d97de226283225e3f90386aeb8742db637a8bebb1031adf5fa09046f76d87e8dac235b
SSDEEP

384:4sqCm6yocx/Yp7jemiO0nd08/VQ6bgNQC5h7tmRvR6JZlbw8hqIusZzZNX:PSoQA6mlcrRpcnuG

Score

10^/10

njrat sameedlcp evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

SAMEEDLCP

C2

themarlborough.co.vu:5150

Mutex

fb299416afb86ef6ecdbdf6738f8fa6c

Attributes

reg_key
fb299416afb86ef6ecdbdf6738f8fa6c
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Winsvc.exe

pid process

1292 Winsvc.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2412 netsh.exe

pid	process
1292	Winsvc.exe

pid	process
2412	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

Winsvc.exe

description	pid	process
Token: SeDebugPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe
Token: 33	1292	Winsvc.exe
Token: SeIncBasePriorityPrivilege	1292	Winsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8.exeWinsvc.exe

description	pid	process	target process
PID 4824 wrote to memory of 1292	4824	c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8.exe	Winsvc.exe
PID 4824 wrote to memory of 1292	4824	c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8.exe	Winsvc.exe
PID 4824 wrote to memory of 1292	4824	c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8.exe	Winsvc.exe
PID 1292 wrote to memory of 2412	1292	Winsvc.exe	netsh.exe
PID 1292 wrote to memory of 2412	1292	Winsvc.exe	netsh.exe
PID 1292 wrote to memory of 2412	1292	Winsvc.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8.exe
"C:\Users\Admin\AppData\Local\Temp\c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824

C:\Users\Admin\AppData\Roaming\Winsvc.exe
"C:\Users\Admin\AppData\Roaming\Winsvc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Winsvc.exe" "Winsvc.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Winsvc.exe
Filesize
23KB

MD5
b666c4da44542080af4e8d10035e3cae

SHA1
4c1df8d41638200ab51d3c22c6d1854b0544a2e2

SHA256
c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8

SHA512
d8a835e5df93056ce193b4aa64bab04bb0c2a008d9385144500e6057d7d97de226283225e3f90386aeb8742db637a8bebb1031adf5fa09046f76d87e8dac235b

Download Submit
C:\Users\Admin\AppData\Roaming\Winsvc.exe
Filesize
23KB

MD5
b666c4da44542080af4e8d10035e3cae

SHA1
4c1df8d41638200ab51d3c22c6d1854b0544a2e2

SHA256
c9a6906da93dbfbbf03dbef5eb0f92c08b3d32468bdb34eb7dd14fa4021765e8

SHA512
d8a835e5df93056ce193b4aa64bab04bb0c2a008d9385144500e6057d7d97de226283225e3f90386aeb8742db637a8bebb1031adf5fa09046f76d87e8dac235b

Download Submit
memory/1292-133-0x0000000000000000-mapping.dmp

Download
memory/1292-137-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/1292-139-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/2412-138-0x0000000000000000-mapping.dmp

Download
memory/4824-132-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/4824-136-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads