njrat | 6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9

General

Target

6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe
Size

273KB
MD5

943dfdf0cb1cd51076480b836bd70601
SHA1

38f473ac03dd3c9c1ff2b2230bc0e191f4d53050
SHA256

6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9
SHA512

928cafbbd79f4419e5e543c55aa1d3dc4fcb58cb5242f10ada2de1a926ff558719e84e3b1aab0e42ed73bd7bfb587869f33f7f8ba72ec3b3ce572d5f5010e8b1
SSDEEP

6144:at3aCHQiRgkktkhvgyFvatu6REsyzBaM577vWJeN1rj4:+qCwkgkktkhI8yY6Ral7/k

Score

10^/10

njrat byuac evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

byuac

C2

queda2122.ddns.net:90

Mutex

ff62a63ef9ea27a176ace35d8efdbe51

Attributes

reg_key
ff62a63ef9ea27a176ace35d8efdbe51
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

1.exe

pid process

808 1.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

616 netsh.exe

pid	process
808	1.exe

pid	process
616	netsh.exe

Drops startup file 2 IoCs

Processes:

1.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ff62a63ef9ea27a176ace35d8efdbe51.exe	1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ff62a63ef9ea27a176ace35d8efdbe51.exe	1.exe

Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

932 cmd.exe

pid	process
932	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ff62a63ef9ea27a176ace35d8efdbe51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1.exe\" .."	1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ff62a63ef9ea27a176ace35d8efdbe51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1.exe\" .."	1.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

752 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1.exe

pid process

808 1.exe

pid	process
752	PING.EXE

pid	process
808	1.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

1.exe

description	pid	process
Token: SeDebugPrivilege	808	1.exe
Token: 33	808	1.exe
Token: SeIncBasePriorityPrivilege	808	1.exe
Token: 33	808	1.exe
Token: SeIncBasePriorityPrivilege	808	1.exe
Token: 33	808	1.exe
Token: SeIncBasePriorityPrivilege	808	1.exe
Token: 33	808	1.exe
Token: SeIncBasePriorityPrivilege	808	1.exe
Token: 33	808	1.exe
Token: SeIncBasePriorityPrivilege	808	1.exe
Token: 33	808	1.exe
Token: SeIncBasePriorityPrivilege	808	1.exe
Token: 33	808	1.exe
Token: SeIncBasePriorityPrivilege	808	1.exe
Token: 33	808	1.exe
Token: SeIncBasePriorityPrivilege	808	1.exe
Token: 33	808	1.exe
Token: SeIncBasePriorityPrivilege	808	1.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.execmd.exe1.exe

description	pid	process	target process
PID 1520 wrote to memory of 932	1520	6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe	cmd.exe
PID 1520 wrote to memory of 932	1520	6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe	cmd.exe
PID 1520 wrote to memory of 932	1520	6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe	cmd.exe
PID 1520 wrote to memory of 932	1520	6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe	cmd.exe
PID 932 wrote to memory of 752	932	cmd.exe	PING.EXE
PID 932 wrote to memory of 752	932	cmd.exe	PING.EXE
PID 932 wrote to memory of 752	932	cmd.exe	PING.EXE
PID 932 wrote to memory of 752	932	cmd.exe	PING.EXE
PID 932 wrote to memory of 808	932	cmd.exe	1.exe
PID 932 wrote to memory of 808	932	cmd.exe	1.exe
PID 932 wrote to memory of 808	932	cmd.exe	1.exe
PID 932 wrote to memory of 808	932	cmd.exe	1.exe
PID 808 wrote to memory of 616	808	1.exe	netsh.exe
PID 808 wrote to memory of 616	808	1.exe	netsh.exe
PID 808 wrote to memory of 616	808	1.exe	netsh.exe
PID 808 wrote to memory of 616	808	1.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe
"C:\Users\Admin\AppData\Local\Temp\6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /k ping 127.0.0.1 & start C:\Users\Admin\AppData\Local\Temp\1.exe & exit
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:752

C:\Users\Admin\AppData\Local\Temp\1.exe
C:\Users\Admin\AppData\Local\Temp\1.exe
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1.exe" "1.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.exe
Filesize
273KB

MD5
943dfdf0cb1cd51076480b836bd70601

SHA1
38f473ac03dd3c9c1ff2b2230bc0e191f4d53050

SHA256
6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9

SHA512
928cafbbd79f4419e5e543c55aa1d3dc4fcb58cb5242f10ada2de1a926ff558719e84e3b1aab0e42ed73bd7bfb587869f33f7f8ba72ec3b3ce572d5f5010e8b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe
Filesize
273KB

MD5
943dfdf0cb1cd51076480b836bd70601

SHA1
38f473ac03dd3c9c1ff2b2230bc0e191f4d53050

SHA256
6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9

SHA512
928cafbbd79f4419e5e543c55aa1d3dc4fcb58cb5242f10ada2de1a926ff558719e84e3b1aab0e42ed73bd7bfb587869f33f7f8ba72ec3b3ce572d5f5010e8b1

Download Submit
\Users\Admin\AppData\Local\Temp\1.exe
Filesize
273KB

MD5
943dfdf0cb1cd51076480b836bd70601

SHA1
38f473ac03dd3c9c1ff2b2230bc0e191f4d53050

SHA256
6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9

SHA512
928cafbbd79f4419e5e543c55aa1d3dc4fcb58cb5242f10ada2de1a926ff558719e84e3b1aab0e42ed73bd7bfb587869f33f7f8ba72ec3b3ce572d5f5010e8b1

Download Submit
memory/616-63-0x0000000000000000-mapping.dmp

Download
memory/616-64-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/752-56-0x0000000000000000-mapping.dmp

Download
memory/808-59-0x0000000000000000-mapping.dmp

Download
memory/808-61-0x0000000000030000-0x0000000000072000-memory.dmp

Filesize
264KB

Download
memory/808-62-0x0000000000330000-0x000000000033C000-memory.dmp

Filesize
48KB

Download
memory/932-55-0x0000000000000000-mapping.dmp

Download
memory/1520-54-0x0000000000DC0000-0x0000000000E02000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads