njrat | cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0

General

Target

cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0.exe
Size

752KB
MD5

453ad7a8f4bf0ffedc5ef0e45b73510c
SHA1

1b1bff14df6326f46b355aafdb988c8f92b6fe4b
SHA256

cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0
SHA512

0add258f4118d01f5cbd74075a69f99ff366e8f470a6ee7fdded75716c72ac13fa630c63a2652e2bd42e1d19c398e1ac8930c32e2eb83350ff9414b316b62bcb
SSDEEP

12288:KS2hAvVLLjdwYXQcToP3K7yvwZxtduJfP5W/61MPKt38Tzgjo2qF7:0ALLjd3XQcUIN0NBW/6FSUM2G

Score

10^/10

njrat hacked_by_mohamed_adel evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed_By_Mohamed_adel

C2

192.168.1.4:5552

Mutex

9e5db6b5a8766217d14c2d56de95562b

Attributes

reg_key
9e5db6b5a8766217d14c2d56de95562b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

LocalDKCxNMDmbS.exeserver.exe

pid process

1656 LocalDKCxNMDmbS.exe
1072 server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

576 netsh.exe

pid	process
1656	LocalDKCxNMDmbS.exe
1072	server.exe

pid	process
576	netsh.exe

Drops startup file 2 IoCs

Processes:

server.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e5db6b5a8766217d14c2d56de95562b.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e5db6b5a8766217d14c2d56de95562b.exe	server.exe

Loads dropped DLL 1 IoCs

Processes:

LocalDKCxNMDmbS.exe

pid process

1656 LocalDKCxNMDmbS.exe

pid	process
1656	LocalDKCxNMDmbS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\9e5db6b5a8766217d14c2d56de95562b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9e5db6b5a8766217d14c2d56de95562b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	1072	server.exe
Token: 33	1072	server.exe
Token: SeIncBasePriorityPrivilege	1072	server.exe
Token: 33	1072	server.exe
Token: SeIncBasePriorityPrivilege	1072	server.exe
Token: 33	1072	server.exe
Token: SeIncBasePriorityPrivilege	1072	server.exe
Token: 33	1072	server.exe
Token: SeIncBasePriorityPrivilege	1072	server.exe
Token: 33	1072	server.exe
Token: SeIncBasePriorityPrivilege	1072	server.exe
Token: 33	1072	server.exe
Token: SeIncBasePriorityPrivilege	1072	server.exe
Token: 33	1072	server.exe
Token: SeIncBasePriorityPrivilege	1072	server.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0.exeLocalDKCxNMDmbS.exeserver.exe

description	pid	process	target process
PID 1464 wrote to memory of 1656	1464	cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0.exe	LocalDKCxNMDmbS.exe
PID 1464 wrote to memory of 1656	1464	cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0.exe	LocalDKCxNMDmbS.exe
PID 1464 wrote to memory of 1656	1464	cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0.exe	LocalDKCxNMDmbS.exe
PID 1464 wrote to memory of 1656	1464	cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0.exe	LocalDKCxNMDmbS.exe
PID 1656 wrote to memory of 1072	1656	LocalDKCxNMDmbS.exe	server.exe
PID 1656 wrote to memory of 1072	1656	LocalDKCxNMDmbS.exe	server.exe
PID 1656 wrote to memory of 1072	1656	LocalDKCxNMDmbS.exe	server.exe
PID 1656 wrote to memory of 1072	1656	LocalDKCxNMDmbS.exe	server.exe
PID 1072 wrote to memory of 576	1072	server.exe	netsh.exe
PID 1072 wrote to memory of 576	1072	server.exe	netsh.exe
PID 1072 wrote to memory of 576	1072	server.exe	netsh.exe
PID 1072 wrote to memory of 576	1072	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0.exe
"C:\Users\Admin\AppData\Local\Temp\cd904c26898bafc784c8478b8535cff623f4f42c80bae27d97307fb3b90397d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Users\Admin\AppData\LocalDKCxNMDmbS.exe
"C:\Users\Admin\AppData\LocalDKCxNMDmbS.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalDKCxNMDmbS.exe

Filesize
33KB

MD5
02d014cf58d106915b7bdea7e6d9d125

SHA1
f52bb30da5fcc08847e33cf950fbdd140ad4ef89

SHA256
49125b8af1c676e17f6d2a15e5649f316eb2f8ca8a797169973eb2c8384158a1

SHA512
e0fe0bcac3643f4eb379422e9d0bcfd59ca5ce4e7a9a1cab0b689c1e4a9dfb66279f0cc42e5c7f582e7e3c8c1ab1f03ebafaa12c8a1201d2687c43c5716d829a

Download Submit
C:\Users\Admin\AppData\LocalDKCxNMDmbS.exe

Filesize
33KB

MD5
02d014cf58d106915b7bdea7e6d9d125

SHA1
f52bb30da5fcc08847e33cf950fbdd140ad4ef89

SHA256
49125b8af1c676e17f6d2a15e5649f316eb2f8ca8a797169973eb2c8384158a1

SHA512
e0fe0bcac3643f4eb379422e9d0bcfd59ca5ce4e7a9a1cab0b689c1e4a9dfb66279f0cc42e5c7f582e7e3c8c1ab1f03ebafaa12c8a1201d2687c43c5716d829a

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
33KB

MD5
02d014cf58d106915b7bdea7e6d9d125

SHA1
f52bb30da5fcc08847e33cf950fbdd140ad4ef89

SHA256
49125b8af1c676e17f6d2a15e5649f316eb2f8ca8a797169973eb2c8384158a1

SHA512
e0fe0bcac3643f4eb379422e9d0bcfd59ca5ce4e7a9a1cab0b689c1e4a9dfb66279f0cc42e5c7f582e7e3c8c1ab1f03ebafaa12c8a1201d2687c43c5716d829a

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
33KB

MD5
02d014cf58d106915b7bdea7e6d9d125

SHA1
f52bb30da5fcc08847e33cf950fbdd140ad4ef89

SHA256
49125b8af1c676e17f6d2a15e5649f316eb2f8ca8a797169973eb2c8384158a1

SHA512
e0fe0bcac3643f4eb379422e9d0bcfd59ca5ce4e7a9a1cab0b689c1e4a9dfb66279f0cc42e5c7f582e7e3c8c1ab1f03ebafaa12c8a1201d2687c43c5716d829a

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
33KB

MD5
02d014cf58d106915b7bdea7e6d9d125

SHA1
f52bb30da5fcc08847e33cf950fbdd140ad4ef89

SHA256
49125b8af1c676e17f6d2a15e5649f316eb2f8ca8a797169973eb2c8384158a1

SHA512
e0fe0bcac3643f4eb379422e9d0bcfd59ca5ce4e7a9a1cab0b689c1e4a9dfb66279f0cc42e5c7f582e7e3c8c1ab1f03ebafaa12c8a1201d2687c43c5716d829a

Download Submit
memory/576-70-0x0000000000000000-mapping.dmp

Download
memory/1072-68-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/1072-64-0x0000000000000000-mapping.dmp

Download
memory/1072-71-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/1464-60-0x000000001B010000-0x000000001B020000-memory.dmp

Filesize
64KB

Download
memory/1464-55-0x000007FEFBBA1000-0x000007FEFBBA3000-memory.dmp

Filesize
8KB

Download
memory/1464-54-0x000007FEF3730000-0x000007FEF4153000-memory.dmp

Filesize
10.1MB

Download
memory/1656-61-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/1656-62-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/1656-56-0x0000000000000000-mapping.dmp

Download
memory/1656-69-0x0000000074600000-0x0000000074BAB000-memory.dmp

Filesize
5.7MB

Download
memory/1656-59-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads