njrat | 97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d

General

Target

97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exe
Size

124KB
MD5

840b83b5502535a2c3aaea19f33cc1b2
SHA1

f1d303370b2d40411cd56d6068c7c3a3d4ecd94f
SHA256

97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d
SHA512

113b88db22a08c158493ee92018096012deee8705e3c3cf8a2d87775632c9bcbc9ae97d9ea397527a423a5314975b0a9cfbb1f880d2ffebb24967e60e4c8726f
SSDEEP

1536:A1uhNcWrbho4GpsNgEX6YaSd4Psq0PXpmWu79B1ArPUco9FLdS1EAd4kkVIIOQSu:rNcW3wsBraBIpPQMPozgEAQIIOG

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

VMware Workstation.exe

pid process

1588 VMware Workstation.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2316 netsh.exe

pid	process
1588	VMware Workstation.exe

pid	process
2316	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exe

Drops startup file 2 IoCs

Processes:

VMware Workstation.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c4a1a58e16cc8ace1c5c169f0db4be4e.exe	VMware Workstation.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c4a1a58e16cc8ace1c5c169f0db4be4e.exe	VMware Workstation.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

VMware Workstation.exe97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Workstation = "C:\\Users\\Admin\\AppData\\Local\\Workstation.exe"	VMware Workstation.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c4a1a58e16cc8ace1c5c169f0db4be4e = "\"C:\\Users\\Admin\\AppData\\Roaming\\VMware Workstation.exe\" .."	VMware Workstation.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c4a1a58e16cc8ace1c5c169f0db4be4e = "\"C:\\Users\\Admin\\AppData\\Roaming\\VMware Workstation.exe\" .."	VMware Workstation.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Workstation = "C:\\Users\\Admin\\AppData\\Local\\Workstation.exe"	97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

VMware Workstation.exe

description	pid	process
Token: SeDebugPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe
Token: 33	1588	VMware Workstation.exe
Token: SeIncBasePriorityPrivilege	1588	VMware Workstation.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exeVMware Workstation.exe

description	pid	process	target process
PID 4640 wrote to memory of 1588	4640	97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exe	VMware Workstation.exe
PID 4640 wrote to memory of 1588	4640	97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exe	VMware Workstation.exe
PID 1588 wrote to memory of 2316	1588	VMware Workstation.exe	netsh.exe
PID 1588 wrote to memory of 2316	1588	VMware Workstation.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exe
"C:\Users\Admin\AppData\Local\Temp\97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4640

C:\Users\Admin\AppData\Roaming\VMware Workstation.exe
"C:\Users\Admin\AppData\Roaming\VMware Workstation.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\VMware Workstation.exe" "VMware Workstation.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\VMware Workstation.exe
Filesize
124KB

MD5
840b83b5502535a2c3aaea19f33cc1b2

SHA1
f1d303370b2d40411cd56d6068c7c3a3d4ecd94f

SHA256
97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d

SHA512
113b88db22a08c158493ee92018096012deee8705e3c3cf8a2d87775632c9bcbc9ae97d9ea397527a423a5314975b0a9cfbb1f880d2ffebb24967e60e4c8726f

Download Submit
C:\Users\Admin\AppData\Roaming\VMware Workstation.exe
Filesize
124KB

MD5
840b83b5502535a2c3aaea19f33cc1b2

SHA1
f1d303370b2d40411cd56d6068c7c3a3d4ecd94f

SHA256
97aa0bd887fc098b4ee45fb85abc29224b799e081c4d8910a574bb06cc055d6d

SHA512
113b88db22a08c158493ee92018096012deee8705e3c3cf8a2d87775632c9bcbc9ae97d9ea397527a423a5314975b0a9cfbb1f880d2ffebb24967e60e4c8726f

Download Submit
memory/1588-133-0x0000000000000000-mapping.dmp

Download
memory/1588-136-0x00007FFCA9460000-0x00007FFCA9E96000-memory.dmp

Filesize
10.2MB

Download
memory/2316-137-0x0000000000000000-mapping.dmp

Download
memory/4640-132-0x00007FFCA9460000-0x00007FFCA9E96000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads