b5b601f10aa5bd54485c06f1df7633e51c172d7053b9b437fe693ede43b6d8c4

General

Target

NjRat Attacker.exe
Size

703KB
MD5

9936a450d518824463e30cf007020244
SHA1

14a72c0f04982dcda07a45ade15cf27d1b482ffe
SHA256

4f8418dc705be19e5d031bf388a698633541b5697f18c935013b011010f840ef
SHA512

16d0105bcd008000442ab6b61065e56e6c57e3aafde6231baa712c44510083f467ca07c52deca03c4aa42fa71301f955086bda442ae9fd272fcaa4869d7ec7fc
SSDEEP

12288:IwEjZRYiaqpvzSnGIJWDW4+FCOFehumXluwvRZX7jFjVHkoLic:UZeOvzS3JWDW4YC6ZmX3Z3VVV

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Server.exeTrojan.exe

pid process

1228 Server.exe
2040 Trojan.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1372 netsh.exe

pid	process
1228	Server.exe
2040	Trojan.exe

pid	process
1372	netsh.exe

Drops startup file 2 IoCs

Processes:

Trojan.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cd9e051ed80df1a0c0b000059793bab8.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cd9e051ed80df1a0c0b000059793bab8.exe	Trojan.exe

Loads dropped DLL 2 IoCs

Processes:

NjRat Attacker.exeServer.exe

pid process

896 NjRat Attacker.exe
1228 Server.exe

pid	process
896	NjRat Attacker.exe
1228	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Trojan.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\cd9e051ed80df1a0c0b000059793bab8 = "\"C:\\ProgramData\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cd9e051ed80df1a0c0b000059793bab8 = "\"C:\\ProgramData\\Trojan.exe\" .."	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Trojan.exe

pid process

2040 Trojan.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Trojan.exe

description pid process

Token: SeDebugPrivilege 2040 Trojan.exe

pid	process
2040	Trojan.exe

description	pid	process
Token: SeDebugPrivilege	2040	Trojan.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

NjRat Attacker.exeServer.exeTrojan.exe

description	pid	process	target process
PID 896 wrote to memory of 1228	896	NjRat Attacker.exe	Server.exe
PID 896 wrote to memory of 1228	896	NjRat Attacker.exe	Server.exe
PID 896 wrote to memory of 1228	896	NjRat Attacker.exe	Server.exe
PID 896 wrote to memory of 1228	896	NjRat Attacker.exe	Server.exe
PID 1228 wrote to memory of 2040	1228	Server.exe	Trojan.exe
PID 1228 wrote to memory of 2040	1228	Server.exe	Trojan.exe
PID 1228 wrote to memory of 2040	1228	Server.exe	Trojan.exe
PID 1228 wrote to memory of 2040	1228	Server.exe	Trojan.exe
PID 2040 wrote to memory of 1372	2040	Trojan.exe	netsh.exe
PID 2040 wrote to memory of 1372	2040	Trojan.exe	netsh.exe
PID 2040 wrote to memory of 1372	2040	Trojan.exe	netsh.exe
PID 2040 wrote to memory of 1372	2040	Trojan.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\NjRat Attacker.exe
"C:\Users\Admin\AppData\Local\Temp\NjRat Attacker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228

C:\ProgramData\Trojan.exe
"C:\ProgramData\Trojan.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\ProgramData\Trojan.exe" "Trojan.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:1372

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Trojan.exe
Filesize
43KB

MD5
bb803adb69c65916507ce753ad4d2ff3

SHA1
120dfd761204de4b337f1565bad87c807ec1da48

SHA256
2f40577e93c47b014bdbd0e878e39c585f3263c9f6837627a4b3c3e159169309

SHA512
8113319e75a6628c2c2ff160cc4da6d7157ee5d358a92cc7621a92da2bb5eb3c1744ad22982f4b9e55ce15631d151660855077aa6ac89ae01ca6052e620cc5a1

Download Submit
C:\ProgramData\Trojan.exe
Filesize
43KB

MD5
bb803adb69c65916507ce753ad4d2ff3

SHA1
120dfd761204de4b337f1565bad87c807ec1da48

SHA256
2f40577e93c47b014bdbd0e878e39c585f3263c9f6837627a4b3c3e159169309

SHA512
8113319e75a6628c2c2ff160cc4da6d7157ee5d358a92cc7621a92da2bb5eb3c1744ad22982f4b9e55ce15631d151660855077aa6ac89ae01ca6052e620cc5a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
bb803adb69c65916507ce753ad4d2ff3

SHA1
120dfd761204de4b337f1565bad87c807ec1da48

SHA256
2f40577e93c47b014bdbd0e878e39c585f3263c9f6837627a4b3c3e159169309

SHA512
8113319e75a6628c2c2ff160cc4da6d7157ee5d358a92cc7621a92da2bb5eb3c1744ad22982f4b9e55ce15631d151660855077aa6ac89ae01ca6052e620cc5a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
bb803adb69c65916507ce753ad4d2ff3

SHA1
120dfd761204de4b337f1565bad87c807ec1da48

SHA256
2f40577e93c47b014bdbd0e878e39c585f3263c9f6837627a4b3c3e159169309

SHA512
8113319e75a6628c2c2ff160cc4da6d7157ee5d358a92cc7621a92da2bb5eb3c1744ad22982f4b9e55ce15631d151660855077aa6ac89ae01ca6052e620cc5a1

Download Submit
\ProgramData\Trojan.exe
Filesize
43KB

MD5
bb803adb69c65916507ce753ad4d2ff3

SHA1
120dfd761204de4b337f1565bad87c807ec1da48

SHA256
2f40577e93c47b014bdbd0e878e39c585f3263c9f6837627a4b3c3e159169309

SHA512
8113319e75a6628c2c2ff160cc4da6d7157ee5d358a92cc7621a92da2bb5eb3c1744ad22982f4b9e55ce15631d151660855077aa6ac89ae01ca6052e620cc5a1

Download Submit
\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
bb803adb69c65916507ce753ad4d2ff3

SHA1
120dfd761204de4b337f1565bad87c807ec1da48

SHA256
2f40577e93c47b014bdbd0e878e39c585f3263c9f6837627a4b3c3e159169309

SHA512
8113319e75a6628c2c2ff160cc4da6d7157ee5d358a92cc7621a92da2bb5eb3c1744ad22982f4b9e55ce15631d151660855077aa6ac89ae01ca6052e620cc5a1

Download Submit
memory/896-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1228-60-0x0000000074860000-0x0000000074E0B000-memory.dmp

Filesize
5.7MB

Download
memory/1228-56-0x0000000000000000-mapping.dmp

Download
memory/1228-67-0x0000000074860000-0x0000000074E0B000-memory.dmp

Filesize
5.7MB

Download
memory/1372-66-0x0000000000000000-mapping.dmp

Download
memory/2040-62-0x0000000000000000-mapping.dmp

Download
memory/2040-68-0x0000000074860000-0x0000000074E0B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-70-0x0000000074860000-0x0000000074E0B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads