njrat | 02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da

General

Target

02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da.exe
Size

29KB
MD5

6baaa9ca95e971f82580b4a510039a5f
SHA1

3928602fe0a7957b9ceba78395c80316c2806f9f
SHA256

02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da
SHA512

1a27e455214faf70c71838c7c2ee4b9e7a93afe57a04db96e3d9d207ca7dc548cce5cc31298723b66ea4c810fdd6930b0820a665a169e73a9cbeae3e4411ef74
SSDEEP

384:46FLvll7jBFoYoKTZl15nRTGumqDAt3eI6GBsbh0w4wlAokw9OhgOL1vYRGOZzDg:B73oYosFnTAqM3eoBKh0p29SgRLW7

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

127.0.0.1:1286

Mutex

9a7a22109d76f01e532be01c0b9f7a61

Attributes

reg_key
9a7a22109d76f01e532be01c0b9f7a61
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
908	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9a7a22109d76f01e532be01c0b9f7a61.exe	Photoshop+CS5+ME+_Portable+by+thaer159.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9a7a22109d76f01e532be01c0b9f7a61.exe	Photoshop+CS5+ME+_Portable+by+thaer159.exe

Loads dropped DLL 1 IoCs

pid	Process
1164	02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\9a7a22109d76f01e532be01c0b9f7a61 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Photoshop+CS5+ME+_Portable+by+thaer159.exe\" .."	Photoshop+CS5+ME+_Portable+by+thaer159.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9a7a22109d76f01e532be01c0b9f7a61 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Photoshop+CS5+ME+_Portable+by+thaer159.exe\" .."	Photoshop+CS5+ME+_Portable+by+thaer159.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe
1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1088	1164	02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da.exe	28
PID 1164 wrote to memory of 1088	1164	02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da.exe	28
PID 1164 wrote to memory of 1088	1164	02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da.exe	28
PID 1164 wrote to memory of 1088	1164	02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da.exe	28
PID 1088 wrote to memory of 908	1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe	29
PID 1088 wrote to memory of 908	1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe	29
PID 1088 wrote to memory of 908	1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe	29
PID 1088 wrote to memory of 908	1088	Photoshop+CS5+ME+_Portable+by+thaer159.exe	29

C:\Users\Admin\AppData\Local\Temp\02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da.exe
"C:\Users\Admin\AppData\Local\Temp\02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\Photoshop+CS5+ME+_Portable+by+thaer159.exe
  "C:\Users\Admin\AppData\Local\Temp\Photoshop+CS5+ME+_Portable+by+thaer159.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Photoshop+CS5+ME+_Portable+by+thaer159.exe" "Photoshop+CS5+ME+_Portable+by+thaer159.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Photoshop+CS5+ME+_Portable+by+thaer159.exe

Filesize
29KB

MD5
6baaa9ca95e971f82580b4a510039a5f

SHA1
3928602fe0a7957b9ceba78395c80316c2806f9f

SHA256
02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da

SHA512
1a27e455214faf70c71838c7c2ee4b9e7a93afe57a04db96e3d9d207ca7dc548cce5cc31298723b66ea4c810fdd6930b0820a665a169e73a9cbeae3e4411ef74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Photoshop+CS5+ME+_Portable+by+thaer159.exe

Filesize
29KB

MD5
6baaa9ca95e971f82580b4a510039a5f

SHA1
3928602fe0a7957b9ceba78395c80316c2806f9f

SHA256
02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da

SHA512
1a27e455214faf70c71838c7c2ee4b9e7a93afe57a04db96e3d9d207ca7dc548cce5cc31298723b66ea4c810fdd6930b0820a665a169e73a9cbeae3e4411ef74

Download Submit
\Users\Admin\AppData\Local\Temp\Photoshop+CS5+ME+_Portable+by+thaer159.exe

Filesize
29KB

MD5
6baaa9ca95e971f82580b4a510039a5f

SHA1
3928602fe0a7957b9ceba78395c80316c2806f9f

SHA256
02129f72f331ff32999b3434e0fa84c98786dab5240370efa04b7c0f011d40da

SHA512
1a27e455214faf70c71838c7c2ee4b9e7a93afe57a04db96e3d9d207ca7dc548cce5cc31298723b66ea4c810fdd6930b0820a665a169e73a9cbeae3e4411ef74

Download Submit
memory/908-62-0x0000000000000000-mapping.dmp

Download
memory/1088-57-0x0000000000000000-mapping.dmp

Download
memory/1088-64-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1088-65-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1164-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1164-55-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1164-61-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing