njrat | f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8

General

Target

f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe
Size

439KB
MD5

53f7914b4ad0114be2205b5f2feff8b3
SHA1

b66b6323b8cebd89ff5db2698ebeb76bbafaf4c6
SHA256

f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8
SHA512

b50d9f85a7ea3939bbae5424c1558784a032ccceee8f58c3a7f0d65da1d634e171b200499006ed6ae4f3ec1218a223b01c7be2b165a3e79aa345b9d45319ae21
SSDEEP

6144:KOraF0ipFssZt57/yd3tFnruc/wInL5OZpKYSfRdZYO/5RfKKC70T:nulXxveddp3nL5fp3ZpLVC7

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

motaga8.no-ip.biz:1177

Mutex

ecc7c8c51c0850c1ec247c7fd3602f20

Attributes

reg_key
ecc7c8c51c0850c1ec247c7fd3602f20
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
988	BLYrKIBpJH9zJj5F0S48.exe
1996	windows.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1752	netsh.exe

Loads dropped DLL 2 IoCs

pid	Process
1680	f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe
988	BLYrKIBpJH9zJj5F0S48.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .."	windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .."	windows.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe
1996	windows.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	windows.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 988	1680	f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe	28
PID 1680 wrote to memory of 988	1680	f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe	28
PID 1680 wrote to memory of 988	1680	f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe	28
PID 1680 wrote to memory of 988	1680	f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe	28
PID 988 wrote to memory of 1996	988	BLYrKIBpJH9zJj5F0S48.exe	29
PID 988 wrote to memory of 1996	988	BLYrKIBpJH9zJj5F0S48.exe	29
PID 988 wrote to memory of 1996	988	BLYrKIBpJH9zJj5F0S48.exe	29
PID 988 wrote to memory of 1996	988	BLYrKIBpJH9zJj5F0S48.exe	29
PID 1996 wrote to memory of 1752	1996	windows.exe	30
PID 1996 wrote to memory of 1752	1996	windows.exe	30
PID 1996 wrote to memory of 1752	1996	windows.exe	30
PID 1996 wrote to memory of 1752	1996	windows.exe	30

C:\Users\Admin\AppData\Local\Temp\f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe
"C:\Users\Admin\AppData\Local\Temp\f5c98664c8edee079c19b854622493cd3ce7bb89904986c339e378a045b9fbe8.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\BLYrKIBpJH9zJj5F0S48.exe
  "C:\Users\Admin\AppData\Local\Temp\BLYrKIBpJH9zJj5F0S48.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Users\Admin\AppData\Local\Temp\windows.exe
    "C:\Users\Admin\AppData\Local\Temp\windows.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BLYrKIBpJH9zJj5F0S48.exe

Filesize
29KB

MD5
8afe13361aedbb7cf0ad509e5b3f1bf7

SHA1
f4922ee13a9878468cd37325b6b6dcd809a3cadc

SHA256
61cce32a75853694cb30bfca429ed1477e6fe784dba1c0ad4221e423e6503329

SHA512
3a33842c3805e8a876d02ca1f40a52ab88698a8b3dfa591b761b19d6045a3a1ae4ca6690b8f19fabb2e66aefd5d250f65c9c5cd701909bdd081f8fcd0205b7df

Download Submit
C:\Users\Admin\AppData\Local\Temp\BLYrKIBpJH9zJj5F0S48.exe

Filesize
29KB

MD5
8afe13361aedbb7cf0ad509e5b3f1bf7

SHA1
f4922ee13a9878468cd37325b6b6dcd809a3cadc

SHA256
61cce32a75853694cb30bfca429ed1477e6fe784dba1c0ad4221e423e6503329

SHA512
3a33842c3805e8a876d02ca1f40a52ab88698a8b3dfa591b761b19d6045a3a1ae4ca6690b8f19fabb2e66aefd5d250f65c9c5cd701909bdd081f8fcd0205b7df

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe

Filesize
29KB

MD5
8afe13361aedbb7cf0ad509e5b3f1bf7

SHA1
f4922ee13a9878468cd37325b6b6dcd809a3cadc

SHA256
61cce32a75853694cb30bfca429ed1477e6fe784dba1c0ad4221e423e6503329

SHA512
3a33842c3805e8a876d02ca1f40a52ab88698a8b3dfa591b761b19d6045a3a1ae4ca6690b8f19fabb2e66aefd5d250f65c9c5cd701909bdd081f8fcd0205b7df

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe

Filesize
29KB

MD5
8afe13361aedbb7cf0ad509e5b3f1bf7

SHA1
f4922ee13a9878468cd37325b6b6dcd809a3cadc

SHA256
61cce32a75853694cb30bfca429ed1477e6fe784dba1c0ad4221e423e6503329

SHA512
3a33842c3805e8a876d02ca1f40a52ab88698a8b3dfa591b761b19d6045a3a1ae4ca6690b8f19fabb2e66aefd5d250f65c9c5cd701909bdd081f8fcd0205b7df

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

Filesize
514B

MD5
f0459bdcd3ad72cacda158371bc833d9

SHA1
5e4781cb495f81bf96895b0877baaf3790787dc7

SHA256
a892974b645ef70008ed2c46f90b16882388f5708f77af4b8c4144049dbd8db1

SHA512
35b1e4ad9cf650a3cefbf9bc0117f6229ff89a7f0a2d18a93ba640b8a2e7f16e3f0900724ed34670c6df48a9b4028a8e8a22af28acbaa9c4085f7aeeddbf0f32

Download Submit
\Users\Admin\AppData\Local\Temp\BLYrKIBpJH9zJj5F0S48.exe

Filesize
29KB

MD5
8afe13361aedbb7cf0ad509e5b3f1bf7

SHA1
f4922ee13a9878468cd37325b6b6dcd809a3cadc

SHA256
61cce32a75853694cb30bfca429ed1477e6fe784dba1c0ad4221e423e6503329

SHA512
3a33842c3805e8a876d02ca1f40a52ab88698a8b3dfa591b761b19d6045a3a1ae4ca6690b8f19fabb2e66aefd5d250f65c9c5cd701909bdd081f8fcd0205b7df

Download Submit
\Users\Admin\AppData\Local\Temp\windows.exe

Filesize
29KB

MD5
8afe13361aedbb7cf0ad509e5b3f1bf7

SHA1
f4922ee13a9878468cd37325b6b6dcd809a3cadc

SHA256
61cce32a75853694cb30bfca429ed1477e6fe784dba1c0ad4221e423e6503329

SHA512
3a33842c3805e8a876d02ca1f40a52ab88698a8b3dfa591b761b19d6045a3a1ae4ca6690b8f19fabb2e66aefd5d250f65c9c5cd701909bdd081f8fcd0205b7df

Download Submit
memory/988-67-0x0000000074E90000-0x000000007543B000-memory.dmp

Filesize
5.7MB

Download
memory/1680-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1680-55-0x0000000074E90000-0x000000007543B000-memory.dmp

Filesize
5.7MB

Download
memory/1680-71-0x0000000074E90000-0x000000007543B000-memory.dmp

Filesize
5.7MB

Download
memory/1996-68-0x0000000074E90000-0x000000007543B000-memory.dmp

Filesize
5.7MB

Download
memory/1996-72-0x0000000074E90000-0x000000007543B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing