njrat | ff974eed3a39673cfe330cf7ed87521887301ab58b71d7dd2d6d15fc197313b5

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

njRAT v0.7d.exe
Size

55KB
MD5

cac62bc1ad7ba8129d87f1bc1178c814
SHA1

55f02c854540df27c4d57ace83c5c91c37cf36e9
SHA256

4bc7b459b9842ad4dfaadbb8c280119945050d4cc46780f3fdd3bc3a9c44d027
SHA512

972f793b8396d9064d52407701b5b731b21f7a4604bae1b37cbff1aa3fcd72064a71e20838b3f7bfaf35d6703de9ea69f909271be0ca5b0055f1ad89af8dade7
SSDEEP

768:sI3KDIyPKpLwby2f+ucnE4D/JJmjbaccM4lKSO9IQ:srDwfD/JJmvRUKSO9R

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

Njratv0.7.exewindows.exe

pid process

3904 Njratv0.7.exe
3440 windows.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

556 netsh.exe

pid	process
3904	Njratv0.7.exe
3440	windows.exe

pid	process
556	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

njRAT v0.7d.exeNjratv0.7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	njRAT v0.7d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Njratv0.7.exe

Drops startup file 2 IoCs

Processes:

windows.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\386657da1e60be4194c71697712e8f87.exe	windows.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\386657da1e60be4194c71697712e8f87.exe	windows.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windows.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\386657da1e60be4194c71697712e8f87 = "\"C:\\ProgramData\\windows.exe\" .."	windows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\386657da1e60be4194c71697712e8f87 = "\"C:\\ProgramData\\windows.exe\" .."	windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 45 IoCs

Processes:

windows.exe

pid	process
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe
3440	windows.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

windows.exe

description pid process

Token: SeDebugPrivilege 3440 windows.exe

description	pid	process
Token: SeDebugPrivilege	3440	windows.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

njRAT v0.7d.exeNjratv0.7.exewindows.exe

description	pid	process	target process
PID 4656 wrote to memory of 3904	4656	njRAT v0.7d.exe	Njratv0.7.exe
PID 4656 wrote to memory of 3904	4656	njRAT v0.7d.exe	Njratv0.7.exe
PID 4656 wrote to memory of 3904	4656	njRAT v0.7d.exe	Njratv0.7.exe
PID 3904 wrote to memory of 3440	3904	Njratv0.7.exe	windows.exe
PID 3904 wrote to memory of 3440	3904	Njratv0.7.exe	windows.exe
PID 3904 wrote to memory of 3440	3904	Njratv0.7.exe	windows.exe
PID 3440 wrote to memory of 556	3440	windows.exe	netsh.exe
PID 3440 wrote to memory of 556	3440	windows.exe	netsh.exe
PID 3440 wrote to memory of 556	3440	windows.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\njRAT v0.7d.exe
"C:\Users\Admin\AppData\Local\Temp\njRAT v0.7d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4656

C:\Users\Admin\AppData\Local\Temp\Njratv0.7.exe
"C:\Users\Admin\AppData\Local\Temp\Njratv0.7.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3904

C:\ProgramData\windows.exe
"C:\ProgramData\windows.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\ProgramData\windows.exe" "windows.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\windows.exe
Filesize
28KB

MD5
52a8409c1094fc21866c83db6b3d25e8

SHA1
fb4dd5992c5d04230e8c06a5a3b01c16f0ffb7e2

SHA256
ed28ce0ebc2df6fb53fab91089db3c3b6fe1b386fca1ea8c242a54ee3aba336a

SHA512
fb434b535ed8df2ec91ccbc89cdec60e3b09c39bf8d69ea3354dea2a5ffc536da830ca0f21fc2912467c3e6f76a875ba28bd04600cf4ca950bac9174c108a33c

Download Submit
C:\ProgramData\windows.exe
Filesize
28KB

MD5
52a8409c1094fc21866c83db6b3d25e8

SHA1
fb4dd5992c5d04230e8c06a5a3b01c16f0ffb7e2

SHA256
ed28ce0ebc2df6fb53fab91089db3c3b6fe1b386fca1ea8c242a54ee3aba336a

SHA512
fb434b535ed8df2ec91ccbc89cdec60e3b09c39bf8d69ea3354dea2a5ffc536da830ca0f21fc2912467c3e6f76a875ba28bd04600cf4ca950bac9174c108a33c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Njratv0.7.exe
Filesize
28KB

MD5
52a8409c1094fc21866c83db6b3d25e8

SHA1
fb4dd5992c5d04230e8c06a5a3b01c16f0ffb7e2

SHA256
ed28ce0ebc2df6fb53fab91089db3c3b6fe1b386fca1ea8c242a54ee3aba336a

SHA512
fb434b535ed8df2ec91ccbc89cdec60e3b09c39bf8d69ea3354dea2a5ffc536da830ca0f21fc2912467c3e6f76a875ba28bd04600cf4ca950bac9174c108a33c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Njratv0.7.exe
Filesize
28KB

MD5
52a8409c1094fc21866c83db6b3d25e8

SHA1
fb4dd5992c5d04230e8c06a5a3b01c16f0ffb7e2

SHA256
ed28ce0ebc2df6fb53fab91089db3c3b6fe1b386fca1ea8c242a54ee3aba336a

SHA512
fb434b535ed8df2ec91ccbc89cdec60e3b09c39bf8d69ea3354dea2a5ffc536da830ca0f21fc2912467c3e6f76a875ba28bd04600cf4ca950bac9174c108a33c

Download Submit
memory/556-140-0x0000000000000000-mapping.dmp

Download
memory/3440-136-0x0000000000000000-mapping.dmp

Download
memory/3440-141-0x0000000075330000-0x00000000758E1000-memory.dmp

Filesize
5.7MB

Download
memory/3440-142-0x0000000075330000-0x00000000758E1000-memory.dmp

Filesize
5.7MB

Download
memory/3904-132-0x0000000000000000-mapping.dmp

Download
memory/3904-135-0x0000000075330000-0x00000000758E1000-memory.dmp

Filesize
5.7MB

Download
memory/3904-139-0x0000000075330000-0x00000000758E1000-memory.dmp

Filesize
5.7MB

Download