njrat | 57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

General

Target

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
Size

117KB
MD5

54ef63adae22a3f65e31292fc73e0988
SHA1

bbb0a96f006a633bb1326b14958516b42f1d37cc
SHA256

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8
SHA512

dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437
SSDEEP

3072:bC2FWOpfhDgaXBp2EIdXeAZqjHGcPjzqU+0VU:f02FxnIZetbXG+

Score

10^/10

njrat hecked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hecked

C2

tarikkungfeude.no-ip.biz:1177

Mutex

ff5b36e94ed32112d022b6a1fe2be27e

Attributes

reg_key
ff5b36e94ed32112d022b6a1fe2be27e
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

vlc.exevlc.exe

pid process

884 vlc.exe
1476 vlc.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1724 netsh.exe

pid	process
884	vlc.exe
1476	vlc.exe

pid	process
1724	netsh.exe

Loads dropped DLL 3 IoCs

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exevlc.exe

pid	process
1256	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1256	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
884	vlc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vlc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ff5b36e94ed32112d022b6a1fe2be27e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\" .."	vlc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ff5b36e94ed32112d022b6a1fe2be27e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\" .."	vlc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exevlc.exe

description	pid	process	target process
PID 1632 set thread context of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 884 set thread context of 1476	884	vlc.exe	vlc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exevlc.exe

pid	process
1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
884	vlc.exe
884	vlc.exe
884	vlc.exe
884	vlc.exe
884	vlc.exe
884	vlc.exe
884	vlc.exe
884	vlc.exe
884	vlc.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exevlc.exevlc.exe

description	pid	process
Token: SeDebugPrivilege	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
Token: SeDebugPrivilege	884	vlc.exe
Token: SeDebugPrivilege	1476	vlc.exe
Token: 33	1476	vlc.exe
Token: SeIncBasePriorityPrivilege	1476	vlc.exe
Token: 33	1476	vlc.exe
Token: SeIncBasePriorityPrivilege	1476	vlc.exe
Token: 33	1476	vlc.exe
Token: SeIncBasePriorityPrivilege	1476	vlc.exe
Token: 33	1476	vlc.exe
Token: SeIncBasePriorityPrivilege	1476	vlc.exe
Token: 33	1476	vlc.exe
Token: SeIncBasePriorityPrivilege	1476	vlc.exe
Token: 33	1476	vlc.exe
Token: SeIncBasePriorityPrivilege	1476	vlc.exe
Token: 33	1476	vlc.exe
Token: SeIncBasePriorityPrivilege	1476	vlc.exe
Token: 33	1476	vlc.exe
Token: SeIncBasePriorityPrivilege	1476	vlc.exe
Token: 33	1476	vlc.exe
Token: SeIncBasePriorityPrivilege	1476	vlc.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exevlc.exevlc.exe

description	pid	process	target process
PID 1632 wrote to memory of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1632 wrote to memory of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1632 wrote to memory of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1632 wrote to memory of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1632 wrote to memory of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1632 wrote to memory of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1632 wrote to memory of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1632 wrote to memory of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1632 wrote to memory of 1256	1632	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1256 wrote to memory of 884	1256	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	vlc.exe
PID 1256 wrote to memory of 884	1256	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	vlc.exe
PID 1256 wrote to memory of 884	1256	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	vlc.exe
PID 1256 wrote to memory of 884	1256	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	vlc.exe
PID 884 wrote to memory of 1476	884	vlc.exe	vlc.exe
PID 884 wrote to memory of 1476	884	vlc.exe	vlc.exe
PID 884 wrote to memory of 1476	884	vlc.exe	vlc.exe
PID 884 wrote to memory of 1476	884	vlc.exe	vlc.exe
PID 884 wrote to memory of 1476	884	vlc.exe	vlc.exe
PID 884 wrote to memory of 1476	884	vlc.exe	vlc.exe
PID 884 wrote to memory of 1476	884	vlc.exe	vlc.exe
PID 884 wrote to memory of 1476	884	vlc.exe	vlc.exe
PID 884 wrote to memory of 1476	884	vlc.exe	vlc.exe
PID 1476 wrote to memory of 1724	1476	vlc.exe	netsh.exe
PID 1476 wrote to memory of 1724	1476	vlc.exe	netsh.exe
PID 1476 wrote to memory of 1724	1476	vlc.exe	netsh.exe
PID 1476 wrote to memory of 1724	1476	vlc.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
"C:\Users\Admin\AppData\Local\Temp\57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
  C:\Users\Admin\AppData\Local\Temp\57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Users\Admin\AppData\Local\Temp\vlc.exe
    "C:\Users\Admin\AppData\Local\Temp\vlc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Users\Admin\AppData\Local\Temp\vlc.exe
      C:\Users\Admin\AppData\Local\Temp\vlc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\vlc.exe" "vlc.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vlc.exe

Filesize
117KB

MD5
54ef63adae22a3f65e31292fc73e0988

SHA1
bbb0a96f006a633bb1326b14958516b42f1d37cc

SHA256
57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

SHA512
dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlc.exe

Filesize
117KB

MD5
54ef63adae22a3f65e31292fc73e0988

SHA1
bbb0a96f006a633bb1326b14958516b42f1d37cc

SHA256
57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

SHA512
dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlc.exe

Filesize
117KB

MD5
54ef63adae22a3f65e31292fc73e0988

SHA1
bbb0a96f006a633bb1326b14958516b42f1d37cc

SHA256
57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

SHA512
dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437

Download Submit
\Users\Admin\AppData\Local\Temp\vlc.exe

Filesize
117KB

MD5
54ef63adae22a3f65e31292fc73e0988

SHA1
bbb0a96f006a633bb1326b14958516b42f1d37cc

SHA256
57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

SHA512
dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437

Download Submit
\Users\Admin\AppData\Local\Temp\vlc.exe

Filesize
117KB

MD5
54ef63adae22a3f65e31292fc73e0988

SHA1
bbb0a96f006a633bb1326b14958516b42f1d37cc

SHA256
57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

SHA512
dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437

Download Submit
\Users\Admin\AppData\Local\Temp\vlc.exe

Filesize
117KB

MD5
54ef63adae22a3f65e31292fc73e0988

SHA1
bbb0a96f006a633bb1326b14958516b42f1d37cc

SHA256
57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

SHA512
dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437

Download Submit
memory/884-68-0x0000000000000000-mapping.dmp

Download
memory/884-86-0x0000000000455000-0x0000000000466000-memory.dmp

Filesize
68KB

Download
memory/884-85-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/884-83-0x0000000000455000-0x0000000000466000-memory.dmp

Filesize
68KB

Download
memory/884-73-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1256-57-0x000000000040748E-mapping.dmp

Download
memory/1256-72-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1256-61-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1256-63-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/1476-84-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/1476-76-0x000000000040748E-mapping.dmp

Download
memory/1476-89-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/1632-55-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/1632-64-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/1632-65-0x0000000000955000-0x0000000000966000-memory.dmp

Filesize
68KB

Download
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1724-87-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads