njrat | 57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

General

Target

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
Size

117KB
MD5

54ef63adae22a3f65e31292fc73e0988
SHA1

bbb0a96f006a633bb1326b14958516b42f1d37cc
SHA256

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8
SHA512

dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437
SSDEEP

3072:bC2FWOpfhDgaXBp2EIdXeAZqjHGcPjzqU+0VU:f02FxnIZetbXG+

Score

10^/10

njrat hecked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hecked

C2

tarikkungfeude.no-ip.biz:1177

Mutex

ff5b36e94ed32112d022b6a1fe2be27e

Attributes

reg_key
ff5b36e94ed32112d022b6a1fe2be27e
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

vlc.exevlc.exe

pid process

4180 vlc.exe
2044 vlc.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4948 netsh.exe

pid	process
4180	vlc.exe
2044	vlc.exe

pid	process
4948	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vlc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ff5b36e94ed32112d022b6a1fe2be27e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\" .."	vlc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ff5b36e94ed32112d022b6a1fe2be27e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\" .."	vlc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exevlc.exe

description	pid	process	target process
PID 1436 set thread context of 5016	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 4180 set thread context of 2044	4180	vlc.exe	vlc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exevlc.exe

pid	process
1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
4180	vlc.exe
4180	vlc.exe
4180	vlc.exe
4180	vlc.exe
4180	vlc.exe
4180	vlc.exe
4180	vlc.exe
4180	vlc.exe
4180	vlc.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exevlc.exevlc.exe

description	pid	process
Token: SeDebugPrivilege	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
Token: SeDebugPrivilege	4180	vlc.exe
Token: SeDebugPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe
Token: 33	2044	vlc.exe
Token: SeIncBasePriorityPrivilege	2044	vlc.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exevlc.exevlc.exe

description	pid	process	target process
PID 1436 wrote to memory of 5016	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1436 wrote to memory of 5016	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1436 wrote to memory of 5016	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1436 wrote to memory of 5016	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1436 wrote to memory of 5016	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1436 wrote to memory of 5016	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1436 wrote to memory of 5016	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 1436 wrote to memory of 5016	1436	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
PID 5016 wrote to memory of 4180	5016	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	vlc.exe
PID 5016 wrote to memory of 4180	5016	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	vlc.exe
PID 5016 wrote to memory of 4180	5016	57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe	vlc.exe
PID 4180 wrote to memory of 2044	4180	vlc.exe	vlc.exe
PID 4180 wrote to memory of 2044	4180	vlc.exe	vlc.exe
PID 4180 wrote to memory of 2044	4180	vlc.exe	vlc.exe
PID 4180 wrote to memory of 2044	4180	vlc.exe	vlc.exe
PID 4180 wrote to memory of 2044	4180	vlc.exe	vlc.exe
PID 4180 wrote to memory of 2044	4180	vlc.exe	vlc.exe
PID 4180 wrote to memory of 2044	4180	vlc.exe	vlc.exe
PID 4180 wrote to memory of 2044	4180	vlc.exe	vlc.exe
PID 2044 wrote to memory of 4948	2044	vlc.exe	netsh.exe
PID 2044 wrote to memory of 4948	2044	vlc.exe	netsh.exe
PID 2044 wrote to memory of 4948	2044	vlc.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
"C:\Users\Admin\AppData\Local\Temp\57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
  C:\Users\Admin\AppData\Local\Temp\57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\vlc.exe
    "C:\Users\Admin\AppData\Local\Temp\vlc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\vlc.exe
      C:\Users\Admin\AppData\Local\Temp\vlc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\vlc.exe" "vlc.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:4948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8.exe.log

Filesize
587B

MD5
ec1d4f8482eabd1b31097b6b83fd2d06

SHA1
b00d2dca5c255ccc34a50b5a5ed894afabf13ba6

SHA256
f7c7efd546b3232d33f49656fcf5a5d883400fe2fa27b40c60db695c4a16c671

SHA512
a21cd5912f1cee6663ad16b687a0ff1383fc921be5edc8ebf30b7d3b3cfcbb63a356e0b600eba05e62d900887b3e3fb0fa44eaf8453af2ce35319476c4e5e992

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlc.exe

Filesize
117KB

MD5
54ef63adae22a3f65e31292fc73e0988

SHA1
bbb0a96f006a633bb1326b14958516b42f1d37cc

SHA256
57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

SHA512
dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlc.exe

Filesize
117KB

MD5
54ef63adae22a3f65e31292fc73e0988

SHA1
bbb0a96f006a633bb1326b14958516b42f1d37cc

SHA256
57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

SHA512
dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlc.exe

Filesize
117KB

MD5
54ef63adae22a3f65e31292fc73e0988

SHA1
bbb0a96f006a633bb1326b14958516b42f1d37cc

SHA256
57910bc5597e7df03d4d1631bc836b92530ed5865d3ed9a05d5e2df8759d41a8

SHA512
dcc82f1247cae2268ea5192e874f6836ca4548750067ec24b9b70706fb2118f9c54c92f4c1f726dc71775326e1151c7f1075316836c758f5f270efd61e028437

Download Submit
memory/1436-133-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/1436-132-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/1436-137-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/2044-144-0x0000000000000000-mapping.dmp

Download
memory/2044-147-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/2044-150-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/4180-138-0x0000000000000000-mapping.dmp

Download
memory/4180-143-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/4180-148-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/4948-149-0x0000000000000000-mapping.dmp

Download
memory/5016-136-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/5016-142-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/5016-135-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5016-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads