njrat | 9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c

General

Target

9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c.exe
Size

111KB
MD5

7f06af4daf30a10baa152fdc52a3680d
SHA1

378fc79c50bb028781b907d84a2bab105673e801
SHA256

9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c
SHA512

84b26c0155374a2a93dfaae5ccc615a1f02a92f5fe276140163f108ddf69be703a0886484239ba1b29ab6e9a276df0ffbc0a9aadfdb75c2b33cd799ae2826362
SSDEEP

3072:tM/LO9qCD8qD81rxA1647lFFainRuAHNPRa0qN1h:SCderOGYmX

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

windows.exe

pid process

3796 windows.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

5016 netsh.exe

pid	process
3796	windows.exe

pid	process
5016	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c.exe

Drops startup file 2 IoCs

Processes:

windows.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\41317d65cbd61c873c5b673362508423.exe	windows.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\41317d65cbd61c873c5b673362508423.exe	windows.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windows.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41317d65cbd61c873c5b673362508423 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .."	windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41317d65cbd61c873c5b673362508423 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .."	windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

windows.exe

description	pid	process
Token: SeDebugPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe
Token: 33	3796	windows.exe
Token: SeIncBasePriorityPrivilege	3796	windows.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c.exewindows.exe

description	pid	process	target process
PID 1716 wrote to memory of 3796	1716	9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c.exe	windows.exe
PID 1716 wrote to memory of 3796	1716	9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c.exe	windows.exe
PID 3796 wrote to memory of 5016	3796	windows.exe	netsh.exe
PID 3796 wrote to memory of 5016	3796	windows.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c.exe
"C:\Users\Admin\AppData\Local\Temp\9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:5016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\windows.exe
Filesize
111KB

MD5
7f06af4daf30a10baa152fdc52a3680d

SHA1
378fc79c50bb028781b907d84a2bab105673e801

SHA256
9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c

SHA512
84b26c0155374a2a93dfaae5ccc615a1f02a92f5fe276140163f108ddf69be703a0886484239ba1b29ab6e9a276df0ffbc0a9aadfdb75c2b33cd799ae2826362

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
Filesize
111KB

MD5
7f06af4daf30a10baa152fdc52a3680d

SHA1
378fc79c50bb028781b907d84a2bab105673e801

SHA256
9b44ccb6e01dd9a3e020e0dbd26a6d8804fa882729cad3f95dfe2705337aaa0c

SHA512
84b26c0155374a2a93dfaae5ccc615a1f02a92f5fe276140163f108ddf69be703a0886484239ba1b29ab6e9a276df0ffbc0a9aadfdb75c2b33cd799ae2826362

Download Submit
memory/1716-133-0x00007FFFFE6C0000-0x00007FFFFF0F6000-memory.dmp

Filesize
10.2MB

Download
memory/3796-134-0x0000000000000000-mapping.dmp

Download
memory/3796-137-0x00007FFFFE6C0000-0x00007FFFFF0F6000-memory.dmp

Filesize
10.2MB

Download
memory/5016-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads