njrat | 6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2

General

Target

6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2.exe
Size

472KB
MD5

830b15da953bdbf8105474e93876ac9c
SHA1

2e0e49d48644c244e097c4418f1a6c801b9d7805
SHA256

6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2
SHA512

d7260f5f2d7985e3ca4a0783c5c9ff9c5bca8fdd64a0a47a27b9fc2d1c7cbf8bcb5e45b1542fd068dc90cf73a6967b899b53e106314ca5c964c8ad6cae97faf2
SSDEEP

12288:zawtBYX/Xb9X5/yLy7n9LnX+gtV8wAeOQKNKKKKKKKKKKKKKKKKKuKKKKKeKKKK7:FtB8/Xb9X5cyRLX+UVxAeOQKNKKKKKKn

Score

10^/10

njrat fa9o hhhhhhhhhhhhhhhhhhghhhhhhhhhhhhhhh evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

fa9o hhhhhhhhhhhhhhhhhhghhhhhhhhhhhhhhh

C2

gladyatur.no-ip.biz:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
664	LocalwztPcCecpJ.exe
1748	Trojan.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
816	netsh.exe

Loads dropped DLL 1 IoCs

pid	Process
664	LocalwztPcCecpJ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe
1748	Trojan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	Trojan.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 664	1088	6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2.exe	27
PID 1088 wrote to memory of 664	1088	6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2.exe	27
PID 1088 wrote to memory of 664	1088	6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2.exe	27
PID 1088 wrote to memory of 664	1088	6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2.exe	27
PID 664 wrote to memory of 1748	664	LocalwztPcCecpJ.exe	29
PID 664 wrote to memory of 1748	664	LocalwztPcCecpJ.exe	29
PID 664 wrote to memory of 1748	664	LocalwztPcCecpJ.exe	29
PID 664 wrote to memory of 1748	664	LocalwztPcCecpJ.exe	29
PID 1748 wrote to memory of 816	1748	Trojan.exe	31
PID 1748 wrote to memory of 816	1748	Trojan.exe	31
PID 1748 wrote to memory of 816	1748	Trojan.exe	31
PID 1748 wrote to memory of 816	1748	Trojan.exe	31

C:\Users\Admin\AppData\Local\Temp\6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2.exe
"C:\Users\Admin\AppData\Local\Temp\6e172eceb80a6f5684f2a1a144bdd4a869ab9429de0490f8ab187462e46a06b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\LocalwztPcCecpJ.exe
  "C:\Users\Admin\AppData\LocalwztPcCecpJ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Users\Admin\AppData\Local\Temp\Trojan.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
29KB

MD5
f004f039693cae8d8f4cbebccbe03492

SHA1
c4b6583ec61c2aae7c5a02020f08056e2452bc80

SHA256
244f7904b2eefa46c21365c53ce0f2d7a48c8ee8e568705ee6ad3f2e39358e77

SHA512
c1a8135be0b07110ef5fead999f4650ba0ed36dc43eb694fa8d784efa38dc364b77b04fc8a87a0bf7c9353e1c1f6dc5febe24eb8594fd8794511c1fcb14cb3d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
29KB

MD5
f004f039693cae8d8f4cbebccbe03492

SHA1
c4b6583ec61c2aae7c5a02020f08056e2452bc80

SHA256
244f7904b2eefa46c21365c53ce0f2d7a48c8ee8e568705ee6ad3f2e39358e77

SHA512
c1a8135be0b07110ef5fead999f4650ba0ed36dc43eb694fa8d784efa38dc364b77b04fc8a87a0bf7c9353e1c1f6dc5febe24eb8594fd8794511c1fcb14cb3d9

Download Submit
C:\Users\Admin\AppData\LocalwztPcCecpJ.exe

Filesize
29KB

MD5
f004f039693cae8d8f4cbebccbe03492

SHA1
c4b6583ec61c2aae7c5a02020f08056e2452bc80

SHA256
244f7904b2eefa46c21365c53ce0f2d7a48c8ee8e568705ee6ad3f2e39358e77

SHA512
c1a8135be0b07110ef5fead999f4650ba0ed36dc43eb694fa8d784efa38dc364b77b04fc8a87a0bf7c9353e1c1f6dc5febe24eb8594fd8794511c1fcb14cb3d9

Download Submit
C:\Users\Admin\AppData\LocalwztPcCecpJ.exe

Filesize
29KB

MD5
f004f039693cae8d8f4cbebccbe03492

SHA1
c4b6583ec61c2aae7c5a02020f08056e2452bc80

SHA256
244f7904b2eefa46c21365c53ce0f2d7a48c8ee8e568705ee6ad3f2e39358e77

SHA512
c1a8135be0b07110ef5fead999f4650ba0ed36dc43eb694fa8d784efa38dc364b77b04fc8a87a0bf7c9353e1c1f6dc5febe24eb8594fd8794511c1fcb14cb3d9

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
29KB

MD5
f004f039693cae8d8f4cbebccbe03492

SHA1
c4b6583ec61c2aae7c5a02020f08056e2452bc80

SHA256
244f7904b2eefa46c21365c53ce0f2d7a48c8ee8e568705ee6ad3f2e39358e77

SHA512
c1a8135be0b07110ef5fead999f4650ba0ed36dc43eb694fa8d784efa38dc364b77b04fc8a87a0bf7c9353e1c1f6dc5febe24eb8594fd8794511c1fcb14cb3d9

Download Submit
memory/664-59-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/664-61-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/664-67-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/1088-60-0x0000000000D50000-0x0000000000D60000-memory.dmp

Filesize
64KB

Download
memory/1088-54-0x000007FEF3AD0000-0x000007FEF44F3000-memory.dmp

Filesize
10.1MB

Download
memory/1088-55-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download
memory/1748-68-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download
memory/1748-70-0x0000000074000000-0x00000000745AB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing