njrat | 151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57

General

Target

151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe
Size

416KB
MD5

83771882f3cadc168a06c5900c89a2fa
SHA1

ddaa5ba0394fa2dd41806c30aab9dcedcab3c856
SHA256

151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57
SHA512

4b54b280d74ef1fabe0fa1bb3444650570517b6a8079371794b6cb0ab077d2eb7c7bf0c080799d1338568ea690c51cafd071dbb3cf7afd30ed6da25f85a81ced
SSDEEP

6144:/V6JHMBmCeHXBzVdwvuePgSRDooIOq0gkiYpQ/:/cGoZeISRMmYYp

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

aloneone91.hopper.pw:1991

Mutex

5f5756082ee9ac1134f0cd5572ac803a

Attributes

reg_key
5f5756082ee9ac1134f0cd5572ac803a
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.execsrss.exe

pid process

1140 winlogon.exe
3728 winlogon.exe
2664 csrss.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4880 netsh.exe

pid	process
1140	winlogon.exe
3728	winlogon.exe
2664	csrss.exe

pid	process
4880	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exewinlogon.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

winlogon.exe

description pid process target process

PID 1140 set thread context of 3728 1140 winlogon.exe winlogon.exe

description	pid	process	target process
PID 1140 set thread context of 3728	1140	winlogon.exe	winlogon.exe

Drops file in Windows directory 4 IoCs

Processes:

winlogon.exe151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	winlogon.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	winlogon.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

winlogon.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exe

pid	process
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe
2664	csrss.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

csrss.exewinlogon.exe

description	pid	process
Token: SeDebugPrivilege	2664	csrss.exe
Token: SeDebugPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe
Token: 33	3728	winlogon.exe
Token: SeIncBasePriorityPrivilege	3728	winlogon.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 812 wrote to memory of 1140	812	151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe	winlogon.exe
PID 812 wrote to memory of 1140	812	151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe	winlogon.exe
PID 812 wrote to memory of 1140	812	151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe	winlogon.exe
PID 1140 wrote to memory of 3728	1140	winlogon.exe	winlogon.exe
PID 1140 wrote to memory of 3728	1140	winlogon.exe	winlogon.exe
PID 1140 wrote to memory of 3728	1140	winlogon.exe	winlogon.exe
PID 1140 wrote to memory of 3728	1140	winlogon.exe	winlogon.exe
PID 1140 wrote to memory of 3728	1140	winlogon.exe	winlogon.exe
PID 1140 wrote to memory of 3728	1140	winlogon.exe	winlogon.exe
PID 1140 wrote to memory of 3728	1140	winlogon.exe	winlogon.exe
PID 1140 wrote to memory of 3728	1140	winlogon.exe	winlogon.exe
PID 1140 wrote to memory of 2664	1140	winlogon.exe	csrss.exe
PID 1140 wrote to memory of 2664	1140	winlogon.exe	csrss.exe
PID 1140 wrote to memory of 2664	1140	winlogon.exe	csrss.exe
PID 3728 wrote to memory of 4880	3728	winlogon.exe	netsh.exe
PID 3728 wrote to memory of 4880	3728	winlogon.exe	netsh.exe
PID 3728 wrote to memory of 4880	3728	winlogon.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe
"C:\Users\Admin\AppData\Local\Temp\151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1140

C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe" "winlogon.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:4880

C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe
"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe" -keyhide -prochide 3728 -reg C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe -proc 3728 C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe
Filesize
416KB

MD5
83771882f3cadc168a06c5900c89a2fa

SHA1
ddaa5ba0394fa2dd41806c30aab9dcedcab3c856

SHA256
151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57

SHA512
4b54b280d74ef1fabe0fa1bb3444650570517b6a8079371794b6cb0ab077d2eb7c7bf0c080799d1338568ea690c51cafd071dbb3cf7afd30ed6da25f85a81ced

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe
Filesize
416KB

MD5
83771882f3cadc168a06c5900c89a2fa

SHA1
ddaa5ba0394fa2dd41806c30aab9dcedcab3c856

SHA256
151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57

SHA512
4b54b280d74ef1fabe0fa1bb3444650570517b6a8079371794b6cb0ab077d2eb7c7bf0c080799d1338568ea690c51cafd071dbb3cf7afd30ed6da25f85a81ced

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
Filesize
416KB

MD5
83771882f3cadc168a06c5900c89a2fa

SHA1
ddaa5ba0394fa2dd41806c30aab9dcedcab3c856

SHA256
151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57

SHA512
4b54b280d74ef1fabe0fa1bb3444650570517b6a8079371794b6cb0ab077d2eb7c7bf0c080799d1338568ea690c51cafd071dbb3cf7afd30ed6da25f85a81ced

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
Filesize
416KB

MD5
83771882f3cadc168a06c5900c89a2fa

SHA1
ddaa5ba0394fa2dd41806c30aab9dcedcab3c856

SHA256
151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57

SHA512
4b54b280d74ef1fabe0fa1bb3444650570517b6a8079371794b6cb0ab077d2eb7c7bf0c080799d1338568ea690c51cafd071dbb3cf7afd30ed6da25f85a81ced

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
Filesize
416KB

MD5
83771882f3cadc168a06c5900c89a2fa

SHA1
ddaa5ba0394fa2dd41806c30aab9dcedcab3c856

SHA256
151f1e943b65d61b4243cc03061ec7c2f9be074008d1e987e4246f3f3699cb57

SHA512
4b54b280d74ef1fabe0fa1bb3444650570517b6a8079371794b6cb0ab077d2eb7c7bf0c080799d1338568ea690c51cafd071dbb3cf7afd30ed6da25f85a81ced

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch
Filesize
514B

MD5
75f4ac0fdaa8f343dc5de2709ef73573

SHA1
4e2eff866858ea0b2b2b2425a9f183bcd83d27d9

SHA256
cd39a1fa2a574e3d032165da9457f80d7bd0c08b627b48dd36d407f0177480c9

SHA512
9f6154a944fd203f538e5114f5566f9e3f47c3923815d0633e1461305ae8cdb66f5e582575e925b627801dc929915bde45b5b42d8030030e88a933ee45d346aa

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
Filesize
514B

MD5
75f4ac0fdaa8f343dc5de2709ef73573

SHA1
4e2eff866858ea0b2b2b2425a9f183bcd83d27d9

SHA256
cd39a1fa2a574e3d032165da9457f80d7bd0c08b627b48dd36d407f0177480c9

SHA512
9f6154a944fd203f538e5114f5566f9e3f47c3923815d0633e1461305ae8cdb66f5e582575e925b627801dc929915bde45b5b42d8030030e88a933ee45d346aa

Download Submit
memory/812-132-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/812-133-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/812-147-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/1140-137-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/1140-153-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/1140-138-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/1140-134-0x0000000000000000-mapping.dmp

Download
memory/2664-148-0x0000000000000000-mapping.dmp

Download
memory/2664-152-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/2664-156-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/3728-141-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3728-139-0x0000000000000000-mapping.dmp

Download
memory/3728-146-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/3728-140-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3728-142-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3728-155-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/4880-154-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads