njrat | 6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9

General

Target

6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe
Size

273KB
MD5

943dfdf0cb1cd51076480b836bd70601
SHA1

38f473ac03dd3c9c1ff2b2230bc0e191f4d53050
SHA256

6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9
SHA512

928cafbbd79f4419e5e543c55aa1d3dc4fcb58cb5242f10ada2de1a926ff558719e84e3b1aab0e42ed73bd7bfb587869f33f7f8ba72ec3b3ce572d5f5010e8b1
SSDEEP

6144:at3aCHQiRgkktkhvgyFvatu6REsyzBaM577vWJeN1rj4:+qCwkgkktkhI8yY6Ral7/k

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

1.exe

pid process

4124 1.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4460 netsh.exe

pid	process
4124	1.exe

pid	process
4460	netsh.exe

Drops startup file 2 IoCs

Processes:

1.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ff62a63ef9ea27a176ace35d8efdbe51.exe	1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ff62a63ef9ea27a176ace35d8efdbe51.exe	1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ff62a63ef9ea27a176ace35d8efdbe51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1.exe\" .."	1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ff62a63ef9ea27a176ace35d8efdbe51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1.exe\" .."	1.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2432 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1.exe

pid process

4124 1.exe

pid	process
2432	PING.EXE

pid	process
4124	1.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

1.exe

description	pid	process
Token: SeDebugPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe
Token: 33	4124	1.exe
Token: SeIncBasePriorityPrivilege	4124	1.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.execmd.exe1.exe

description	pid	process	target process
PID 4812 wrote to memory of 4104	4812	6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe	cmd.exe
PID 4812 wrote to memory of 4104	4812	6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe	cmd.exe
PID 4812 wrote to memory of 4104	4812	6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe	cmd.exe
PID 4104 wrote to memory of 2432	4104	cmd.exe	PING.EXE
PID 4104 wrote to memory of 2432	4104	cmd.exe	PING.EXE
PID 4104 wrote to memory of 2432	4104	cmd.exe	PING.EXE
PID 4104 wrote to memory of 4124	4104	cmd.exe	1.exe
PID 4104 wrote to memory of 4124	4104	cmd.exe	1.exe
PID 4104 wrote to memory of 4124	4104	cmd.exe	1.exe
PID 4124 wrote to memory of 4460	4124	1.exe	netsh.exe
PID 4124 wrote to memory of 4460	4124	1.exe	netsh.exe
PID 4124 wrote to memory of 4460	4124	1.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe
"C:\Users\Admin\AppData\Local\Temp\6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /k ping 127.0.0.1 & start C:\Users\Admin\AppData\Local\Temp\1.exe & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4104

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2432

C:\Users\Admin\AppData\Local\Temp\1.exe
C:\Users\Admin\AppData\Local\Temp\1.exe
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1.exe" "1.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:4460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.exe
Filesize
273KB

MD5
943dfdf0cb1cd51076480b836bd70601

SHA1
38f473ac03dd3c9c1ff2b2230bc0e191f4d53050

SHA256
6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9

SHA512
928cafbbd79f4419e5e543c55aa1d3dc4fcb58cb5242f10ada2de1a926ff558719e84e3b1aab0e42ed73bd7bfb587869f33f7f8ba72ec3b3ce572d5f5010e8b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe
Filesize
273KB

MD5
943dfdf0cb1cd51076480b836bd70601

SHA1
38f473ac03dd3c9c1ff2b2230bc0e191f4d53050

SHA256
6d1db3cb8cbcc0467f8cc17a5ffb9381c759f3d9564f458a56e4215287b95ca9

SHA512
928cafbbd79f4419e5e543c55aa1d3dc4fcb58cb5242f10ada2de1a926ff558719e84e3b1aab0e42ed73bd7bfb587869f33f7f8ba72ec3b3ce572d5f5010e8b1

Download Submit
memory/2432-136-0x0000000000000000-mapping.dmp

Download
memory/4104-135-0x0000000000000000-mapping.dmp

Download
memory/4124-137-0x0000000000000000-mapping.dmp

Download
memory/4124-141-0x0000000005650000-0x00000000056E2000-memory.dmp

Filesize
584KB

Download
memory/4124-142-0x0000000005560000-0x000000000556A000-memory.dmp

Filesize
40KB

Download
memory/4460-140-0x0000000000000000-mapping.dmp

Download
memory/4812-132-0x00000000008D0000-0x0000000000912000-memory.dmp

Filesize
264KB

Download
memory/4812-133-0x00000000057F0000-0x0000000005D94000-memory.dmp

Filesize
5.6MB

Download
memory/4812-134-0x00000000052E0000-0x000000000537C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads