njrat | db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647

General

Target

db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe
Size

401KB
MD5

60632a21bdc4e01d73832e6e80ddbf7b
SHA1

4f5872f2e00662c129b0b7e541cd78862db3461c
SHA256

db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647
SHA512

a97ecd3ddd0243cd023ec56c816c0adf11cb85a2aded0c3201a19117726808ec667af0d06ef51c629c6e5867e6ba7567e3fda80c3016bc6ac13a77ec1d49c732
SSDEEP

3072:kx4ITM48SDZSBreHTNVujO/JVUSO2tmmXVhF26:4MFBqHTNEjO/JqC2

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Firefox.exe

pid process

3756 Firefox.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4876 netsh.exe

pid	process
3756	Firefox.exe

pid	process
4876	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Firefox.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0e3d1529a158ba6db2fcfe58fb321719 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Firefox.exe\" .."	Firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0e3d1529a158ba6db2fcfe58fb321719 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Firefox.exe\" .."	Firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exeFirefox.exe

description	pid	process
Token: SeDebugPrivilege	4620	db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe
Token: 33	4620	db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe
Token: SeIncBasePriorityPrivilege	4620	db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe
Token: SeDebugPrivilege	3756	Firefox.exe
Token: 33	3756	Firefox.exe
Token: SeIncBasePriorityPrivilege	3756	Firefox.exe
Token: 33	3756	Firefox.exe
Token: SeIncBasePriorityPrivilege	3756	Firefox.exe
Token: 33	3756	Firefox.exe
Token: SeIncBasePriorityPrivilege	3756	Firefox.exe
Token: 33	3756	Firefox.exe
Token: SeIncBasePriorityPrivilege	3756	Firefox.exe
Token: 33	3756	Firefox.exe
Token: SeIncBasePriorityPrivilege	3756	Firefox.exe
Token: 33	3756	Firefox.exe
Token: SeIncBasePriorityPrivilege	3756	Firefox.exe
Token: 33	3756	Firefox.exe
Token: SeIncBasePriorityPrivilege	3756	Firefox.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exeFirefox.exe

description	pid	process	target process
PID 4620 wrote to memory of 3756	4620	db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe	Firefox.exe
PID 4620 wrote to memory of 3756	4620	db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe	Firefox.exe
PID 3756 wrote to memory of 4876	3756	Firefox.exe	netsh.exe
PID 3756 wrote to memory of 4876	3756	Firefox.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe
"C:\Users\Admin\AppData\Local\Temp\db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620

C:\Users\Admin\AppData\Local\Temp\Firefox.exe
"C:\Users\Admin\AppData\Local\Temp\Firefox.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Firefox.exe" "Firefox.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:4876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Firefox.exe
Filesize
401KB

MD5
60632a21bdc4e01d73832e6e80ddbf7b

SHA1
4f5872f2e00662c129b0b7e541cd78862db3461c

SHA256
db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647

SHA512
a97ecd3ddd0243cd023ec56c816c0adf11cb85a2aded0c3201a19117726808ec667af0d06ef51c629c6e5867e6ba7567e3fda80c3016bc6ac13a77ec1d49c732

Download Submit
C:\Users\Admin\AppData\Local\Temp\Firefox.exe
Filesize
401KB

MD5
60632a21bdc4e01d73832e6e80ddbf7b

SHA1
4f5872f2e00662c129b0b7e541cd78862db3461c

SHA256
db2c557a428446fc053005075800d6107eb3664eecb95ce393e5b5ea511ee647

SHA512
a97ecd3ddd0243cd023ec56c816c0adf11cb85a2aded0c3201a19117726808ec667af0d06ef51c629c6e5867e6ba7567e3fda80c3016bc6ac13a77ec1d49c732

Download Submit
memory/3756-133-0x0000000000000000-mapping.dmp

Download
memory/3756-136-0x000000001C590000-0x000000001CFC6000-memory.dmp

Filesize
10.2MB

Download
memory/4620-132-0x000000001C0A0000-0x000000001CAD6000-memory.dmp

Filesize
10.2MB

Download
memory/4876-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads