njrat | 8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651

General

Target

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Size

102KB
MD5

b04423987d7a01ca1bf5b1f8f2b77b0c
SHA1

6468823f6da30059a2750cf2b4599fdb8e450f05
SHA256

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651
SHA512

c709012177a1d05939e92218111a0e08520166179de4353cc576e88e609fdbf556a99afa3175193a4b7d5d5b38f6688458d0e2e50f549e6f159b46f78bc1b295
SSDEEP

1536:TcTbDj6OLC73ybzlr6kI+KEBXiI40n6aDnOae98fAaMGSSpvvKet2Hbq86Dm:TcX6OWqzlUUBSpE6aDOOvvNtP86Dm

Score

10^/10

njrat pony newhacked collection discovery evasion persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

nEwHacKed

C2

slowburn.linkpc.net:6760

Mutex

a5e14c6feeac7389fad3a06801dddd4f

Attributes

reg_key
a5e14c6feeac7389fad3a06801dddd4f
splitter
|'|'|

Extracted

Family

pony

C2

http://slow1234.serveftp.com/duos/gate.php

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\reader\\adobe.exe,explorer.exe"	reg.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

njratbin.exe

pid process

1732 njratbin.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

840 netsh.exe

pid	process
1732	njratbin.exe

pid	process
840	netsh.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/336-61-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/336-63-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/336-64-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/336-73-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/336-67-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/336-77-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/336-80-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/336-82-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

pid	process
1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

description	pid	process	target process
PID 1488 set thread context of 336	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exenjratbin.exe

pid	process
1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe
1732	njratbin.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exenjratbin.exe

description	pid	process
Token: SeDebugPrivilege	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeImpersonatePrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeTcbPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeChangeNotifyPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeCreateTokenPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeBackupPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeRestorePrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeIncreaseQuotaPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeAssignPrimaryTokenPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeDebugPrivilege	1732	njratbin.exe
Token: SeImpersonatePrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeTcbPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeChangeNotifyPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeCreateTokenPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeBackupPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeRestorePrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeIncreaseQuotaPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeAssignPrimaryTokenPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeImpersonatePrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeTcbPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeChangeNotifyPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeCreateTokenPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeBackupPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeRestorePrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeIncreaseQuotaPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeAssignPrimaryTokenPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeImpersonatePrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeTcbPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeChangeNotifyPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeCreateTokenPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeBackupPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeRestorePrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeIncreaseQuotaPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
Token: SeAssignPrimaryTokenPrivilege	336	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.execmd.exenjratbin.exe

description	pid	process	target process
PID 1488 wrote to memory of 836	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	cmd.exe
PID 1488 wrote to memory of 836	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	cmd.exe
PID 1488 wrote to memory of 836	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	cmd.exe
PID 1488 wrote to memory of 836	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	cmd.exe
PID 836 wrote to memory of 288	836	cmd.exe	reg.exe
PID 836 wrote to memory of 288	836	cmd.exe	reg.exe
PID 836 wrote to memory of 288	836	cmd.exe	reg.exe
PID 836 wrote to memory of 288	836	cmd.exe	reg.exe
PID 1488 wrote to memory of 336	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
PID 1488 wrote to memory of 336	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
PID 1488 wrote to memory of 336	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
PID 1488 wrote to memory of 336	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
PID 1488 wrote to memory of 336	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
PID 1488 wrote to memory of 336	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
PID 1488 wrote to memory of 336	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
PID 1488 wrote to memory of 336	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
PID 1488 wrote to memory of 1732	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	njratbin.exe
PID 1488 wrote to memory of 1732	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	njratbin.exe
PID 1488 wrote to memory of 1732	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	njratbin.exe
PID 1488 wrote to memory of 1732	1488	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe	njratbin.exe
PID 1732 wrote to memory of 840	1732	njratbin.exe	netsh.exe
PID 1732 wrote to memory of 840	1732	njratbin.exe	netsh.exe
PID 1732 wrote to memory of 840	1732	njratbin.exe	netsh.exe
PID 1732 wrote to memory of 840	1732	njratbin.exe	netsh.exe

outlook_win_path 1 IoCs

Processes:

8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe

C:\Users\Admin\AppData\Local\Temp\8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
"C:\Users\Admin\AppData\Local\Temp\8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\reader\adobe.exe,explorer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\reader\adobe.exe,explorer.exe"
    3⤵
    - Modifies WinLogon for persistence
    PID:288
- C:\Users\Admin\AppData\Local\Temp\8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe
  "C:\Users\Admin\AppData\Local\Temp\8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651.exe"
  2⤵
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_win_path
  PID:336
- C:\Users\Admin\AppData\Local\Temp\njratbin.exe
  "C:\Users\Admin\AppData\Local\Temp\njratbin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\njratbin.exe" "njratbin.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\njratbin.exe

Filesize
29KB

MD5
007a4bd3c704a1ddd7d1b04ee9d91c27

SHA1
60843e7a18316d258afba4690a5ecc62c1045795

SHA256
4442506b3211c38811543e2aad5bf276d075734f7967d83a2b3117bc4bad044a

SHA512
e9678f517dbfd58ea51e93576988660d6447b479a61b478a91de7edf6057825a7a8e08d7a147514c6c9d5c2ef11e469de9ee729db2f95ef96c72eeb7e98a4838

Download Submit
C:\Users\Admin\AppData\Local\Temp\njratbin.exe

Filesize
29KB

MD5
007a4bd3c704a1ddd7d1b04ee9d91c27

SHA1
60843e7a18316d258afba4690a5ecc62c1045795

SHA256
4442506b3211c38811543e2aad5bf276d075734f7967d83a2b3117bc4bad044a

SHA512
e9678f517dbfd58ea51e93576988660d6447b479a61b478a91de7edf6057825a7a8e08d7a147514c6c9d5c2ef11e469de9ee729db2f95ef96c72eeb7e98a4838

Download Submit
\Users\Admin\AppData\Local\Temp\njratbin.exe

Filesize
29KB

MD5
007a4bd3c704a1ddd7d1b04ee9d91c27

SHA1
60843e7a18316d258afba4690a5ecc62c1045795

SHA256
4442506b3211c38811543e2aad5bf276d075734f7967d83a2b3117bc4bad044a

SHA512
e9678f517dbfd58ea51e93576988660d6447b479a61b478a91de7edf6057825a7a8e08d7a147514c6c9d5c2ef11e469de9ee729db2f95ef96c72eeb7e98a4838

Download Submit
\Users\Admin\AppData\Roaming\reader\adobe.exe

Filesize
102KB

MD5
b04423987d7a01ca1bf5b1f8f2b77b0c

SHA1
6468823f6da30059a2750cf2b4599fdb8e450f05

SHA256
8edcf97df9e24756e8700a4496dd92d3677fc835925a90d1c48914e369b7f651

SHA512
c709012177a1d05939e92218111a0e08520166179de4353cc576e88e609fdbf556a99afa3175193a4b7d5d5b38f6688458d0e2e50f549e6f159b46f78bc1b295

Download Submit
memory/288-59-0x0000000000000000-mapping.dmp

Download
memory/336-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/336-67-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/336-61-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/336-63-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/336-64-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/336-65-0x000000000041AEC0-mapping.dmp

Download
memory/336-82-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/336-80-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/336-77-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/336-73-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/836-58-0x0000000000000000-mapping.dmp

Download
memory/840-76-0x0000000000000000-mapping.dmp

Download
memory/1488-55-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/1488-54-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/1488-74-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/1488-56-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/1732-78-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/1732-81-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/1732-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads