njrat | 12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b

General

Target

12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b.exe
Size

150KB
MD5

4c4dccdaddf1b58b9222bee18edb69a6
SHA1

49f70f36a3c7bbf62e1c7e90e41eef5c03e13a64
SHA256

12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b
SHA512

24491a933dfafa905a094a825823a21e69c326b471140c029074d9c4d5b1c9670cb6c50c0479e488fb5a4e69f54a8c1747c649f1e1bc6bed1a56b88b6e9c8e96
SSDEEP

3072:boXdtf5llArJxbFdsY19ALHHDIbo6FlCJHA8vgS00fpHeEb0MgoQb5j3Dnnnknn0:bsh5llArJxbFdsY19ADHsbo6FlCJHA8G

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

taskmgr.exe

pid process

3156 taskmgr.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1432 netsh.exe

pid	process
3156	taskmgr.exe

pid	process
1432	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

taskmgr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b3c77cb71f2ff777b40bf54685d5d396 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b3c77cb71f2ff777b40bf54685d5d396 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe
Token: 33	3156	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3156	taskmgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b.exetaskmgr.exe

description	pid	process	target process
PID 2376 wrote to memory of 3156	2376	12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b.exe	taskmgr.exe
PID 2376 wrote to memory of 3156	2376	12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b.exe	taskmgr.exe
PID 3156 wrote to memory of 1432	3156	taskmgr.exe	netsh.exe
PID 3156 wrote to memory of 1432	3156	taskmgr.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b.exe
"C:\Users\Admin\AppData\Local\Temp\12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
  "C:\Users\Admin\AppData\Local\Temp\taskmgr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SYSTEM32\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskmgr.exe" "taskmgr.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
150KB

MD5
4c4dccdaddf1b58b9222bee18edb69a6

SHA1
49f70f36a3c7bbf62e1c7e90e41eef5c03e13a64

SHA256
12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b

SHA512
24491a933dfafa905a094a825823a21e69c326b471140c029074d9c4d5b1c9670cb6c50c0479e488fb5a4e69f54a8c1747c649f1e1bc6bed1a56b88b6e9c8e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Filesize
150KB

MD5
4c4dccdaddf1b58b9222bee18edb69a6

SHA1
49f70f36a3c7bbf62e1c7e90e41eef5c03e13a64

SHA256
12bf7b41e722adfae4604813e99be93a937f802ea0e0effc0c7bcc7973cbed3b

SHA512
24491a933dfafa905a094a825823a21e69c326b471140c029074d9c4d5b1c9670cb6c50c0479e488fb5a4e69f54a8c1747c649f1e1bc6bed1a56b88b6e9c8e96

Download Submit
memory/1432-137-0x0000000000000000-mapping.dmp

Download
memory/2376-132-0x00007FFC1AFA0000-0x00007FFC1B9D6000-memory.dmp

Filesize
10.2MB

Download
memory/3156-133-0x0000000000000000-mapping.dmp

Download
memory/3156-136-0x00007FFC1AFA0000-0x00007FFC1B9D6000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads