njrat | 8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea

Analysis

max time kernel
258s
max time network
327s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea.exe
Size

60KB
MD5

27ea2eade45d9fcd4801e600f2fdba39
SHA1

8b68041329c29bf145097a5726f6f9809992722b
SHA256

8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea
SHA512

93b5223c5812979367905ed1d7eb06b358e1ab04fe6b8a5525c9ce02cb8c184abfe6c69da3f73a1bbf4095f47bea3fe844371e0429ccd6366cd75f153f19335f
SSDEEP

1536:EOIkevE/Lk4alliH7hdKPg6KhG29jLhOlG:+kebvL0g41A29wl

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

127.0.0.1:1177

Mutex

6e6d18dc41426799a2afcd0247b20dc4

Attributes

reg_key
6e6d18dc41426799a2afcd0247b20dc4
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

LocalqLjgPcsHkL.exe

pid process

4344 LocalqLjgPcsHkL.exe

pid	process
4344	LocalqLjgPcsHkL.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea.exeLocalqLjgPcsHkL.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	LocalqLjgPcsHkL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea.exe

description	pid	process	target process
PID 5072 wrote to memory of 4344	5072	8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea.exe	LocalqLjgPcsHkL.exe
PID 5072 wrote to memory of 4344	5072	8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea.exe	LocalqLjgPcsHkL.exe
PID 5072 wrote to memory of 4344	5072	8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea.exe	LocalqLjgPcsHkL.exe

C:\Users\Admin\AppData\Local\Temp\8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea.exe
"C:\Users\Admin\AppData\Local\Temp\8d1dcdebddc85388dca9b70406891e7a1b2b1259c7e4622d7a58c2faca1efaea.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5072

C:\Users\Admin\AppData\LocalqLjgPcsHkL.exe
"C:\Users\Admin\AppData\LocalqLjgPcsHkL.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:4344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalqLjgPcsHkL.exe
Filesize
29KB

MD5
1a34a7a0ebaae51a0b1ddb152bc7c6b5

SHA1
2520e5e2f37e397760f7564b8180ab04b160d1a8

SHA256
567b96467de0a8c2ee97d5d9c15c7a56ca789958c3ca998b86d51afd77631cf6

SHA512
6bcb8829a43fb61588882ebd874aac569caf594006e2a82ac1ed577e37c1d2c4c9b40c538dfbeaa5b7730b0b408d40594ec4fa7bcc957a4cf1590204616868fc

Download Submit
C:\Users\Admin\AppData\LocalqLjgPcsHkL.exe
Filesize
29KB

MD5
1a34a7a0ebaae51a0b1ddb152bc7c6b5

SHA1
2520e5e2f37e397760f7564b8180ab04b160d1a8

SHA256
567b96467de0a8c2ee97d5d9c15c7a56ca789958c3ca998b86d51afd77631cf6

SHA512
6bcb8829a43fb61588882ebd874aac569caf594006e2a82ac1ed577e37c1d2c4c9b40c538dfbeaa5b7730b0b408d40594ec4fa7bcc957a4cf1590204616868fc

Download Submit
memory/4344-133-0x0000000000000000-mapping.dmp

Download
memory/4344-136-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/4344-137-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/5072-132-0x000000001B990000-0x000000001C3C6000-memory.dmp

Filesize
10.2MB

Download