njrat | f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505

General

Target

f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
Size

57KB
MD5

267d180695106d81debe52f6f20ad261
SHA1

151171d9d720d166719f9bb1b95b18007127b946
SHA256

f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505
SHA512

09b4f8c0b8be2eedfa7ebe5f03dd27851778de4d7f161462eb357632a7e37e19adbf44761227a086b80c1455e2b54cfeb299ef9c27155f42f8c289f1dbe3d51c
SSDEEP

1536:Ig+dL1sfm++vZkeQzpKbzuqtGVibs6EFwz96:Ig+dLOe+O/2cMaz

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:1177

Mutex

5649c39203f1efe3450f25e6b18b84f1

Attributes

reg_key
5649c39203f1efe3450f25e6b18b84f1
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

960 server.exe

pid	process
960	server.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe

description	pid	process	target process
PID 1672 set thread context of 968	1672	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe

Drops file in Windows directory 1 IoCs

Processes:

f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe

description ioc process

File created C:\Windows\server.exe f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\server.exe	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exef1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exeserver.exe

description	pid	process	target process
PID 1672 wrote to memory of 968	1672	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
PID 1672 wrote to memory of 968	1672	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
PID 1672 wrote to memory of 968	1672	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
PID 1672 wrote to memory of 968	1672	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
PID 1672 wrote to memory of 968	1672	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
PID 1672 wrote to memory of 968	1672	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
PID 968 wrote to memory of 960	968	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	server.exe
PID 968 wrote to memory of 960	968	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	server.exe
PID 968 wrote to memory of 960	968	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	server.exe
PID 968 wrote to memory of 960	968	f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe	server.exe
PID 960 wrote to memory of 1324	960	server.exe	server.exe
PID 960 wrote to memory of 1324	960	server.exe	server.exe
PID 960 wrote to memory of 1324	960	server.exe	server.exe
PID 960 wrote to memory of 1324	960	server.exe	server.exe

C:\Users\Admin\AppData\Local\Temp\f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
"C:\Users\Admin\AppData\Local\Temp\f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
C:\Users\Admin\AppData\Local\Temp\f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505.exe
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\server.exe
"C:\Windows\server.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\server.exe
C:\Windows\server.exe
4⤵
PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\server.exe

Filesize
57KB

MD5
267d180695106d81debe52f6f20ad261

SHA1
151171d9d720d166719f9bb1b95b18007127b946

SHA256
f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505

SHA512
09b4f8c0b8be2eedfa7ebe5f03dd27851778de4d7f161462eb357632a7e37e19adbf44761227a086b80c1455e2b54cfeb299ef9c27155f42f8c289f1dbe3d51c

Download Submit
C:\Windows\server.exe

Filesize
57KB

MD5
267d180695106d81debe52f6f20ad261

SHA1
151171d9d720d166719f9bb1b95b18007127b946

SHA256
f1c45dcab791f8e0ed057d4f50a564e4f81313151ab0320fbe3bc6c5bac54505

SHA512
09b4f8c0b8be2eedfa7ebe5f03dd27851778de4d7f161462eb357632a7e37e19adbf44761227a086b80c1455e2b54cfeb299ef9c27155f42f8c289f1dbe3d51c

Download Submit
memory/960-65-0x0000000000000000-mapping.dmp

Download
memory/960-70-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/968-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/968-61-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/968-64-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/968-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/968-57-0x000000000040747E-mapping.dmp

Download
memory/968-69-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1672-63-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1672-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1672-55-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing