njrat | 9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5

General

Target

9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Size

700KB
MD5

a9439adb62fd0ccb362f53f2b5c5fc83
SHA1

82970293fbb728e29f3a95b86ac1d843eb4c1a0b
SHA256

9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5
SHA512

d22cbdfea9d6e27c06fa3a131db6c355b97ff6902b7704b57c0e876e93d4da45a2ab5090c89dc08ab14b616a230fd73d3aac65b9a051907aed795f1e9bcb08bb
SSDEEP

12288:judvGqfXWossOS6v5rxO/thd289rKvl+mUoJXpCOxDpBnm7HZZG75gvI8pb2SsIg:judTf1slz5x0fPKvl+PSXpCOxDHn6ZYT

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

260 netsh.exe

pid	process
260	netsh.exe

Drops startup file 2 IoCs

Processes:

9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0e034663390126a1378f4136eb76099f.exe	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0e034663390126a1378f4136eb76099f.exe	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0e034663390126a1378f4136eb76099f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe\" .."	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0e034663390126a1378f4136eb76099f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe\" .."	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe

description	pid	process
Token: SeDebugPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: 33	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: SeIncBasePriorityPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: 33	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: SeIncBasePriorityPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: 33	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: SeIncBasePriorityPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: 33	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: SeIncBasePriorityPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: 33	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: SeIncBasePriorityPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: 33	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: SeIncBasePriorityPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: 33	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: SeIncBasePriorityPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: 33	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: SeIncBasePriorityPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: 33	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
Token: SeIncBasePriorityPrivilege	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe

description	pid	process	target process
PID 1272 wrote to memory of 260	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe	netsh.exe
PID 1272 wrote to memory of 260	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe	netsh.exe
PID 1272 wrote to memory of 260	1272	9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe
"C:\Users\Admin\AppData\Local\Temp\9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe" "9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/260-134-0x0000000000000000-mapping.dmp

Download
memory/1272-132-0x00000000746D0000-0x0000000074C81000-memory.dmp

Filesize
5.7MB

Download
memory/1272-133-0x00000000746D0000-0x0000000074C81000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads