njrat | 9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb

General

Target

9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe
Size

816KB
MD5

c7e0ea419d706b17c546f2165616db01
SHA1

ea2f53f39b43844e356fca1e07594603a2634fcd
SHA256

9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb
SHA512

b013abb1e117788f9191731ab6eeec202e8bcc4e36188ac5eab2217d51b3eb3ebf4bd95a8a12aea154ce0f6e325f9c78be93b936106e6d7d2cc41d8c2146d15c
SSDEEP

24576:Qp9M/ULsy3KihysUYYYYYYYYYYYRYYYYYYYYYYv:7/qsL0yvYYYYYYYYYYYRYYYYYYYYYYv

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

WindowsBenyo.exeexplorer.exe

pid process

4188 WindowsBenyo.exe
2108 explorer.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4396 netsh.exe

pid	process
4188	WindowsBenyo.exe
2108	explorer.exe

pid	process
4396	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe

Drops startup file 2 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d39d2048a79f06f908afa4217eb52f4c.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d39d2048a79f06f908afa4217eb52f4c.exe	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d39d2048a79f06f908afa4217eb52f4c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe\" .."	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d39d2048a79f06f908afa4217eb52f4c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe\" .."	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

explorer.exe

description	pid	process
Token: SeDebugPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe
Token: 33	2108	explorer.exe
Token: SeIncBasePriorityPrivilege	2108	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exeexplorer.exe

description	pid	process	target process
PID 2244 wrote to memory of 4188	2244	9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe	WindowsBenyo.exe
PID 2244 wrote to memory of 4188	2244	9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe	WindowsBenyo.exe
PID 2244 wrote to memory of 2108	2244	9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe	explorer.exe
PID 2244 wrote to memory of 2108	2244	9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe	explorer.exe
PID 2108 wrote to memory of 4396	2108	explorer.exe	netsh.exe
PID 2108 wrote to memory of 4396	2108	explorer.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe
"C:\Users\Admin\AppData\Local\Temp\9273db8f77a2e9efbc7af98c5b45489d466ffc3003b4a2412f71196f06168dbb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2244

C:\Users\Admin\AppData\Local\Temp\WindowsBenyo.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsBenyo.exe"
2⤵
- Executes dropped EXE
PID:4188

C:\Users\Admin\AppData\Local\Temp\explorer.exe
"C:\Users\Admin\AppData\Local\Temp\explorer.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "explorer.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:4396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WindowsBenyo.exe
Filesize
376KB

MD5
f1f3f8a090be54ed9bbc1f127f631383

SHA1
a1e376ad6b039c15c3d54e23f24b515eb5cae5df

SHA256
990b60c90ba91ab8610a21d1047b1a559d238ad81edc30aacc8f0afad065af16

SHA512
7130208b099721bf305fddadfcad83f9071a70936384d5105d27bc455f44a7a46c995e23f072dcffd1ddbdf8970aa92e89efb7759f7f8136c756139d207b8a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsBenyo.exe
Filesize
376KB

MD5
f1f3f8a090be54ed9bbc1f127f631383

SHA1
a1e376ad6b039c15c3d54e23f24b515eb5cae5df

SHA256
990b60c90ba91ab8610a21d1047b1a559d238ad81edc30aacc8f0afad065af16

SHA512
7130208b099721bf305fddadfcad83f9071a70936384d5105d27bc455f44a7a46c995e23f072dcffd1ddbdf8970aa92e89efb7759f7f8136c756139d207b8a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\explorer.exe
Filesize
262KB

MD5
b81aacb4c52347090ad095e458e0217f

SHA1
f685d5ddf22224b26adaf4b1e2220c11801d57e1

SHA256
ecb692c580c8c40e7d1cc54b909e949d623ab19ce0c467f123390f2ef3e6a73b

SHA512
b730393518a43f75ab4d3a00d71171f0c40185dddfa996c83c9e4888579b1eaf0b6ac3d67c91dda6f8b6f367373f1753431afc33592d02a3f441c0930aaa0f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\explorer.exe
Filesize
262KB

MD5
b81aacb4c52347090ad095e458e0217f

SHA1
f685d5ddf22224b26adaf4b1e2220c11801d57e1

SHA256
ecb692c580c8c40e7d1cc54b909e949d623ab19ce0c467f123390f2ef3e6a73b

SHA512
b730393518a43f75ab4d3a00d71171f0c40185dddfa996c83c9e4888579b1eaf0b6ac3d67c91dda6f8b6f367373f1753431afc33592d02a3f441c0930aaa0f82

Download Submit
memory/2108-136-0x0000000000000000-mapping.dmp

Download
memory/2108-140-0x00007FFA05AF0000-0x00007FFA06526000-memory.dmp

Filesize
10.2MB

Download
memory/2244-132-0x00007FFA05AF0000-0x00007FFA06526000-memory.dmp

Filesize
10.2MB

Download
memory/4188-133-0x0000000000000000-mapping.dmp

Download
memory/4188-139-0x0000000000AC0000-0x0000000000B24000-memory.dmp

Filesize
400KB

Download
memory/4188-141-0x00007FFA04F70000-0x00007FFA05A31000-memory.dmp

Filesize
10.8MB

Download
memory/4188-143-0x00007FFA04F70000-0x00007FFA05A31000-memory.dmp

Filesize
10.8MB

Download
memory/4396-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads