njrat | a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6

General

Target

a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe
Size

248KB
MD5

d05139e2f69e5c2b77c2e5e67adeca4d
SHA1

f083153b4e2958629dea2b78342a2379456f215d
SHA256

a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6
SHA512

b9c353638af0df21d2da10371e5b5053c7ab1acf04d67e5c01649c0bd7897d80ffb15e8dfea8bc57ae67672af23d24f33095c8094aa35180d9a34c9fb4877f64
SSDEEP

6144:ylUQRmxln2Ys6hpY2nxb/2jDj/CRX/tQ4s:ylpEps6FpyAVd

Score

10^/10

njrat ‏فہۧايہۧروسہ الہۧعہۧراق هناا evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

‏فہۧايہۧروسہ الہۧعہۧراق هناا

C2

jaki3254.ddns.net:2001

Mutex

85039fd7c6f37e1e0601b12298c6e30f

Attributes

reg_key
85039fd7c6f37e1e0601b12298c6e30f
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

LocalIAZGMMJmLC.exesys02tm.exe

pid process

948 LocalIAZGMMJmLC.exe
1624 sys02tm.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1264 netsh.exe
Loads dropped DLL 1 IoCs

Processes:

LocalIAZGMMJmLC.exe

pid process

948 LocalIAZGMMJmLC.exe

pid	process
948	LocalIAZGMMJmLC.exe
1624	sys02tm.exe

pid	process
1264	netsh.exe

pid	process
948	LocalIAZGMMJmLC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sys02tm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\85039fd7c6f37e1e0601b12298c6e30f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sys02tm.exe\" .."	sys02tm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\85039fd7c6f37e1e0601b12298c6e30f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sys02tm.exe\" .."	sys02tm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\xxx_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.xxx\ = "xxx_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\xxx_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\xxx_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.xxx	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\xxx_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\xxx_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\xxx_auto_file\shell\Read\command	rundll32.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

sys02tm.exe

description	pid	process
Token: SeDebugPrivilege	1624	sys02tm.exe
Token: 33	1624	sys02tm.exe
Token: SeIncBasePriorityPrivilege	1624	sys02tm.exe
Token: 33	1624	sys02tm.exe
Token: SeIncBasePriorityPrivilege	1624	sys02tm.exe
Token: 33	1624	sys02tm.exe
Token: SeIncBasePriorityPrivilege	1624	sys02tm.exe
Token: 33	1624	sys02tm.exe
Token: SeIncBasePriorityPrivilege	1624	sys02tm.exe
Token: 33	1624	sys02tm.exe
Token: SeIncBasePriorityPrivilege	1624	sys02tm.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1552 AcroRd32.exe
1552 AcroRd32.exe
1552 AcroRd32.exe

pid	process
1552	AcroRd32.exe
1552	AcroRd32.exe
1552	AcroRd32.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exerundll32.exeLocalIAZGMMJmLC.exesys02tm.exe

description	pid	process	target process
PID 1808 wrote to memory of 948	1808	a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe	LocalIAZGMMJmLC.exe
PID 1808 wrote to memory of 948	1808	a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe	LocalIAZGMMJmLC.exe
PID 1808 wrote to memory of 948	1808	a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe	LocalIAZGMMJmLC.exe
PID 1808 wrote to memory of 948	1808	a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe	LocalIAZGMMJmLC.exe
PID 1808 wrote to memory of 884	1808	a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe	rundll32.exe
PID 1808 wrote to memory of 884	1808	a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe	rundll32.exe
PID 1808 wrote to memory of 884	1808	a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe	rundll32.exe
PID 884 wrote to memory of 1552	884	rundll32.exe	AcroRd32.exe
PID 884 wrote to memory of 1552	884	rundll32.exe	AcroRd32.exe
PID 884 wrote to memory of 1552	884	rundll32.exe	AcroRd32.exe
PID 884 wrote to memory of 1552	884	rundll32.exe	AcroRd32.exe
PID 948 wrote to memory of 1624	948	LocalIAZGMMJmLC.exe	sys02tm.exe
PID 948 wrote to memory of 1624	948	LocalIAZGMMJmLC.exe	sys02tm.exe
PID 948 wrote to memory of 1624	948	LocalIAZGMMJmLC.exe	sys02tm.exe
PID 948 wrote to memory of 1624	948	LocalIAZGMMJmLC.exe	sys02tm.exe
PID 1624 wrote to memory of 1264	1624	sys02tm.exe	netsh.exe
PID 1624 wrote to memory of 1264	1624	sys02tm.exe	netsh.exe
PID 1624 wrote to memory of 1264	1624	sys02tm.exe	netsh.exe
PID 1624 wrote to memory of 1264	1624	sys02tm.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe
"C:\Users\Admin\AppData\Local\Temp\a75f8943a81e270ae62a5794c43d9cd918f422fc231e36d2a00be29d32471ba6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Admin\AppData\LocalIAZGMMJmLC.exe
"C:\Users\Admin\AppData\LocalIAZGMMJmLC.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\sys02tm.exe
"C:\Users\Admin\AppData\Local\Temp\sys02tm.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\sys02tm.exe" "sys02tm.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:1264

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\LocaljDgxS_kNXn.xxx
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:884

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\LocaljDgxS_kNXn.xxx"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalIAZGMMJmLC.exe
Filesize
23KB

MD5
eb82c80bae91a855301d9038e36da293

SHA1
db1a0655c292cc84f7895aacca94b4e589231712

SHA256
e2c64ef7cbe9137ed88b42e2fe6d97512ff446ca38185d4df6dfa689537077c1

SHA512
541278b79905ab77f494a75a9a479b3e3702368bda46606f7929c77d7e027e654e0ef161b3271a3f074037efc6a2172df9d1d985f7db5f8dd322a27072c866b6

Download Submit
C:\Users\Admin\AppData\LocalIAZGMMJmLC.exe
Filesize
23KB

MD5
eb82c80bae91a855301d9038e36da293

SHA1
db1a0655c292cc84f7895aacca94b4e589231712

SHA256
e2c64ef7cbe9137ed88b42e2fe6d97512ff446ca38185d4df6dfa689537077c1

SHA512
541278b79905ab77f494a75a9a479b3e3702368bda46606f7929c77d7e027e654e0ef161b3271a3f074037efc6a2172df9d1d985f7db5f8dd322a27072c866b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\sys02tm.exe
Filesize
23KB

MD5
eb82c80bae91a855301d9038e36da293

SHA1
db1a0655c292cc84f7895aacca94b4e589231712

SHA256
e2c64ef7cbe9137ed88b42e2fe6d97512ff446ca38185d4df6dfa689537077c1

SHA512
541278b79905ab77f494a75a9a479b3e3702368bda46606f7929c77d7e027e654e0ef161b3271a3f074037efc6a2172df9d1d985f7db5f8dd322a27072c866b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\sys02tm.exe
Filesize
23KB

MD5
eb82c80bae91a855301d9038e36da293

SHA1
db1a0655c292cc84f7895aacca94b4e589231712

SHA256
e2c64ef7cbe9137ed88b42e2fe6d97512ff446ca38185d4df6dfa689537077c1

SHA512
541278b79905ab77f494a75a9a479b3e3702368bda46606f7929c77d7e027e654e0ef161b3271a3f074037efc6a2172df9d1d985f7db5f8dd322a27072c866b6

Download Submit
C:\Users\Admin\AppData\LocaljDgxS_kNXn.xxx
Filesize
10KB

MD5
bd05683dddba651df32a97e4c6d234e1

SHA1
f49806de8299a7a698a415d7c27a988f820ea0e9

SHA256
0a02317a0f832fcfbdb9507f1ba9318f9d69c7225ef90412a3d2aea04171388f

SHA512
e1695b6d828a008250f65df566dc3083ce4e69345455eb3019592a5e6b0a69eb81ccbbbb72a677ab56090f554024a86be2541aa94b07605d056792f3ad935762

Download Submit
\Users\Admin\AppData\Local\Temp\sys02tm.exe
Filesize
23KB

MD5
eb82c80bae91a855301d9038e36da293

SHA1
db1a0655c292cc84f7895aacca94b4e589231712

SHA256
e2c64ef7cbe9137ed88b42e2fe6d97512ff446ca38185d4df6dfa689537077c1

SHA512
541278b79905ab77f494a75a9a479b3e3702368bda46606f7929c77d7e027e654e0ef161b3271a3f074037efc6a2172df9d1d985f7db5f8dd322a27072c866b6

Download Submit
memory/884-59-0x0000000000000000-mapping.dmp

Download
memory/948-64-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/948-66-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/948-56-0x0000000000000000-mapping.dmp

Download
memory/948-72-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1264-75-0x0000000000000000-mapping.dmp

Download
memory/1552-62-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/1552-61-0x0000000000000000-mapping.dmp

Download
memory/1624-68-0x0000000000000000-mapping.dmp

Download
memory/1624-73-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1624-74-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/1808-54-0x000007FEF4600000-0x000007FEF5023000-memory.dmp

Filesize
10.1MB

Download
memory/1808-55-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads