njrat | 2c3aba28dd226f7a429379dcde769bd7d80f27608da1da53ce5c71e4a2b7db7a

General

Target

2c3aba28dd226f7a429379dcde769bd7d80f27608da1da53ce5c71e4a2b7db7a.exe
Size

256KB
MD5

a1063dfcb0fa9b60444d487bd0b99c41
SHA1

e026766de06cde67ae5f2340f0adf55075705d1e
SHA256

2c3aba28dd226f7a429379dcde769bd7d80f27608da1da53ce5c71e4a2b7db7a
SHA512

d0edb45fac2a3362ede118f232ba091eef65f49019e7045a04299912c2332c3b36adc03d0a5c0e1430a25b2fc56988bd7cd879f6ebd597d1ecf5ff58f612dd97
SSDEEP

6144:FPqjOgYeDhxncphQ2Amb/P3JTQYKeobc5AKx:UlYQhxnKSoqDKx

Score

10^/10

njrat hacked by solo evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed by solo

C2

soport-587.zapto.org:1177

Mutex

f37bb6f8d08374d7119032823a62e813

Attributes

reg_key
f37bb6f8d08374d7119032823a62e813
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
1988	LocalLAtmIYAllW.exe
332	server.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1692	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f37bb6f8d08374d7119032823a62e813.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f37bb6f8d08374d7119032823a62e813.exe	server.exe

Loads dropped DLL 1 IoCs

pid	Process
1988	LocalLAtmIYAllW.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\f37bb6f8d08374d7119032823a62e813 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f37bb6f8d08374d7119032823a62e813 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	332	server.exe
Token: 33	332	server.exe
Token: SeIncBasePriorityPrivilege	332	server.exe
Token: 33	332	server.exe
Token: SeIncBasePriorityPrivilege	332	server.exe
Token: 33	332	server.exe
Token: SeIncBasePriorityPrivilege	332	server.exe
Token: 33	332	server.exe
Token: SeIncBasePriorityPrivilege	332	server.exe
Token: 33	332	server.exe
Token: SeIncBasePriorityPrivilege	332	server.exe
Token: 33	332	server.exe
Token: SeIncBasePriorityPrivilege	332	server.exe
Token: 33	332	server.exe
Token: SeIncBasePriorityPrivilege	332	server.exe
Token: 33	332	server.exe
Token: SeIncBasePriorityPrivilege	332	server.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1988	1932	2c3aba28dd226f7a429379dcde769bd7d80f27608da1da53ce5c71e4a2b7db7a.exe	27
PID 1932 wrote to memory of 1988	1932	2c3aba28dd226f7a429379dcde769bd7d80f27608da1da53ce5c71e4a2b7db7a.exe	27
PID 1932 wrote to memory of 1988	1932	2c3aba28dd226f7a429379dcde769bd7d80f27608da1da53ce5c71e4a2b7db7a.exe	27
PID 1932 wrote to memory of 1988	1932	2c3aba28dd226f7a429379dcde769bd7d80f27608da1da53ce5c71e4a2b7db7a.exe	27
PID 1988 wrote to memory of 332	1988	LocalLAtmIYAllW.exe	29
PID 1988 wrote to memory of 332	1988	LocalLAtmIYAllW.exe	29
PID 1988 wrote to memory of 332	1988	LocalLAtmIYAllW.exe	29
PID 1988 wrote to memory of 332	1988	LocalLAtmIYAllW.exe	29
PID 332 wrote to memory of 1692	332	server.exe	31
PID 332 wrote to memory of 1692	332	server.exe	31
PID 332 wrote to memory of 1692	332	server.exe	31
PID 332 wrote to memory of 1692	332	server.exe	31

C:\Users\Admin\AppData\Local\Temp\2c3aba28dd226f7a429379dcde769bd7d80f27608da1da53ce5c71e4a2b7db7a.exe
"C:\Users\Admin\AppData\Local\Temp\2c3aba28dd226f7a429379dcde769bd7d80f27608da1da53ce5c71e4a2b7db7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\LocalLAtmIYAllW.exe
  "C:\Users\Admin\AppData\LocalLAtmIYAllW.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLAtmIYAllW.exe

Filesize
57KB

MD5
ce4e338c9593ac2b72af24345d5dfdde

SHA1
a385ecc8a2cc5ad96993d23071211860db663d55

SHA256
3029140534aa098c3dd8c92b93892310b4923453e18db87f571068ce0373878d

SHA512
24b441b2633e50d9da48042d28dd6a7b02a4b0e6ee87b6c112388f4a085046729bad875d6220ce6fc9fa6477f15228650cf7865a0c4594d4092d2c90149ced57

Download Submit
C:\Users\Admin\AppData\LocalLAtmIYAllW.exe

Filesize
57KB

MD5
ce4e338c9593ac2b72af24345d5dfdde

SHA1
a385ecc8a2cc5ad96993d23071211860db663d55

SHA256
3029140534aa098c3dd8c92b93892310b4923453e18db87f571068ce0373878d

SHA512
24b441b2633e50d9da48042d28dd6a7b02a4b0e6ee87b6c112388f4a085046729bad875d6220ce6fc9fa6477f15228650cf7865a0c4594d4092d2c90149ced57

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
57KB

MD5
ce4e338c9593ac2b72af24345d5dfdde

SHA1
a385ecc8a2cc5ad96993d23071211860db663d55

SHA256
3029140534aa098c3dd8c92b93892310b4923453e18db87f571068ce0373878d

SHA512
24b441b2633e50d9da48042d28dd6a7b02a4b0e6ee87b6c112388f4a085046729bad875d6220ce6fc9fa6477f15228650cf7865a0c4594d4092d2c90149ced57

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
57KB

MD5
ce4e338c9593ac2b72af24345d5dfdde

SHA1
a385ecc8a2cc5ad96993d23071211860db663d55

SHA256
3029140534aa098c3dd8c92b93892310b4923453e18db87f571068ce0373878d

SHA512
24b441b2633e50d9da48042d28dd6a7b02a4b0e6ee87b6c112388f4a085046729bad875d6220ce6fc9fa6477f15228650cf7865a0c4594d4092d2c90149ced57

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
57KB

MD5
ce4e338c9593ac2b72af24345d5dfdde

SHA1
a385ecc8a2cc5ad96993d23071211860db663d55

SHA256
3029140534aa098c3dd8c92b93892310b4923453e18db87f571068ce0373878d

SHA512
24b441b2633e50d9da48042d28dd6a7b02a4b0e6ee87b6c112388f4a085046729bad875d6220ce6fc9fa6477f15228650cf7865a0c4594d4092d2c90149ced57

Download Submit
memory/1932-55-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download
memory/1932-59-0x000000001AF30000-0x000000001AF40000-memory.dmp

Filesize
64KB

Download
memory/1932-54-0x000007FEF49F0000-0x000007FEF5413000-memory.dmp

Filesize
10.1MB

Download
memory/1988-60-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1988-63-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/1988-62-0x0000000000310000-0x0000000000318000-memory.dmp

Filesize
32KB

Download
memory/1988-61-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing