njrat | d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c

General

Target

d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe
Size

240KB
MD5

b30fee632f6b18eb2ff5a49a4e5d7883
SHA1

550238b070088e906fa9ee2aa3477a1321498173
SHA256

d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c
SHA512

28aae9d2412729144d757a489807cb8761abe5f0a93dd43ac3c41d6e03e8c5d67208feebcd421663fc794a26612e2554ed0f53ed583c45b1501e4e0748e8c826
SSDEEP

6144:de95/jDSDls2IN4vuSACO9yux887vyYlPEAOlfJO2EgFTuUB5aW:deyvKz92xhETUx

Score

10^/10

njrat hacked agilenet evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

279f6960ed84a752570aca7fb2dc1552

Attributes

reg_key
279f6960ed84a752570aca7fb2dc1552
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Server.exe

pid process

2028 Server.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1500 netsh.exe

pid	process
2028	Server.exe

pid	process
1500	netsh.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1724-54-0x0000000000250000-0x000000000025C000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Server.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0b54cbd918e0247a41ea5a716aab2c4000000000200000000001066000000010000200000001d4f2f5eefe9607d936b264650c191dafe73aac34c7af344647d3e9953ece3b6000000000e8000000002000020000000cd06087389cce568403ede0e42fa2cf9149034d86b2851da9ed239b969f4e60320000000aeafa9e08296f70cfdb9239ed78baeba565c094a4692468268f2ab2685928185400000008a3de10b20a1fd442acf93390ec4ac4b4f12c45252460a9279912022b9f2fa9a62a3201c0cf87ad4cf27fb6f0487c1fe8121771653759312add5a94b20320557	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c687756b06d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376763606"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F5A4921-725E-11ED-B243-5AF036119C64} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0b54cbd918e0247a41ea5a716aab2c400000000020000000000106600000001000020000000955330e13f1ca5c93cf0832f47f166d277f1ed089b5bda46afc5be10d10e1d08000000000e8000000002000020000000181c5edf729324723e9e5b497144cdbef1f0c1fd23d2b31ebf67c1a1908f38e8900000004c377fb41b72cbde5694e220e965e94cca4f4565c9bd482a4e670fa715945b53226e2c1f4d4f37bd4cf2cd0511849e93003b8ef5cf4023f6cd13071ea584c08cb22848b29a085121475dad0d68a81eaf2168db338a304d1d93af464e08431885e1efc2049674271cc43f065385e94412e7eef912b2c20cca7f414ba7c39a30941b3fbac03af6d969b11e261d778884fc400000001504ef1a03009791d654b978f6281c6b0987dbe0d3cd1c628d9753d489a45c5dba3d8cef66fcc7f00988d1970ae5c4ef1ecdb6995bcebca1112b2490d72c6fff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exeServer.exe

description	pid	process
Token: SeDebugPrivilege	1724	d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe
Token: SeDebugPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe
Token: 33	2028	Server.exe
Token: SeIncBasePriorityPrivilege	2028	Server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2016 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2016 iexplore.exe
2016 iexplore.exe
112 IEXPLORE.EXE
112 IEXPLORE.EXE
112 IEXPLORE.EXE
112 IEXPLORE.EXE

pid	process
2016	iexplore.exe

pid	process
2016	iexplore.exe
2016	iexplore.exe
112	IEXPLORE.EXE
112	IEXPLORE.EXE
112	IEXPLORE.EXE
112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exeiexplore.exeServer.exe

description	pid	process	target process
PID 1724 wrote to memory of 2028	1724	d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe	Server.exe
PID 1724 wrote to memory of 2028	1724	d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe	Server.exe
PID 1724 wrote to memory of 2028	1724	d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe	Server.exe
PID 1724 wrote to memory of 2028	1724	d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe	Server.exe
PID 1724 wrote to memory of 2016	1724	d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe	iexplore.exe
PID 1724 wrote to memory of 2016	1724	d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe	iexplore.exe
PID 1724 wrote to memory of 2016	1724	d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe	iexplore.exe
PID 2016 wrote to memory of 112	2016	iexplore.exe	IEXPLORE.EXE
PID 2016 wrote to memory of 112	2016	iexplore.exe	IEXPLORE.EXE
PID 2016 wrote to memory of 112	2016	iexplore.exe	IEXPLORE.EXE
PID 2016 wrote to memory of 112	2016	iexplore.exe	IEXPLORE.EXE
PID 2028 wrote to memory of 1500	2028	Server.exe	netsh.exe
PID 2028 wrote to memory of 1500	2028	Server.exe	netsh.exe
PID 2028 wrote to memory of 1500	2028	Server.exe	netsh.exe
PID 2028 wrote to memory of 1500	2028	Server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe
"C:\Users\Admin\AppData\Local\Temp\d02e88a87f99105730981411b3dc00838ba8f93f7fee5d2294820e44d38ff28c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1500

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\صورة.gif
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
23KB

MD5
b4ecb77429fd8fb0c2ad0b2e82b99a2a

SHA1
64c90eb7b4c8cf8585fee8950cf842a77546f561

SHA256
0be44ad34deda92d7ce2c7e0093c398606deec502327a9639cc7e574509677c0

SHA512
8333d34d6f9a3cce4fc6c265c5b2ed08839a4f3533b0fdb7fb46e735d64fc61278e226f1c5e67371b98f4b6fa48d33948dc3a04cd4bdee35d18fa4267bd455ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
23KB

MD5
b4ecb77429fd8fb0c2ad0b2e82b99a2a

SHA1
64c90eb7b4c8cf8585fee8950cf842a77546f561

SHA256
0be44ad34deda92d7ce2c7e0093c398606deec502327a9639cc7e574509677c0

SHA512
8333d34d6f9a3cce4fc6c265c5b2ed08839a4f3533b0fdb7fb46e735d64fc61278e226f1c5e67371b98f4b6fa48d33948dc3a04cd4bdee35d18fa4267bd455ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\صورة.gif
Filesize
59KB

MD5
741c4e52b72bf081956f2bad797af2b3

SHA1
f21726792e66c1b171e03b06fd3f6dcd2195bc28

SHA256
ba15f81908ea9cced0d302abbd863f2762dc000d192adcc2532a634c37a0570c

SHA512
48525d79274e84bdde118de182775624fcf6ea34b89dd612dfd990d5b4a5048d89f28daab8913afe42027423ed0616272f7ce5475c485318a3bfe05667a2a095

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9RRL1F63.txt
Filesize
535B

MD5
5cbd2af1e84f66f1585732ab24b3045d

SHA1
2046860e66b7c4618559ace46bd3caf667b4a1a7

SHA256
a05c0b16fda4c0b702af2267d4888780fa47fe5a6364a08948ab86701b1072fc

SHA512
41f8058c598d44302a64dbd85b04ed7ca52fbabfeba49c2bbfd4a4be187d9ed86a77344c6a390551ee39939ec5cc50bdac6612ec35d726538a6eafe5ac18a4ff

Download Submit
memory/1500-61-0x0000000000000000-mapping.dmp

Download
memory/1724-54-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/2028-55-0x0000000000000000-mapping.dmp

Download
memory/2028-58-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/2028-60-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/2028-63-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads