njrat | eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181

General

Target

eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
Size

120KB
MD5

d83c756ecce399c30f15a014d02d2851
SHA1

398025442f70518f8be639173d90ebdf1e6cecd7
SHA256

eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181
SHA512

f0e5d50d41e532688280b1d83bb2fea7fa32ea9895e0b3e65741d0553b11e95256db0293e9bb5090abeea2a25e61af303cd0345deb999ab78b8f8fa689895ee9
SSDEEP

3072:56Z/RVs8BgEpmZAYNqfbcYmbRUX41uiD:5c/7fbfdxi

Score

10^/10

njrat trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

description	pid	process	target process
PID 1356 set thread context of 1340	1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1368 1340 WerFault.exe eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

pid	pid_target	process	target process
1368	1340	WerFault.exe	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

pid	process
1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

description pid process

Token: SeDebugPrivilege 1356 eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

description	pid	process
Token: SeDebugPrivilege	1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exeeb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe

description	pid	process	target process
PID 1356 wrote to memory of 1340	1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
PID 1356 wrote to memory of 1340	1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
PID 1356 wrote to memory of 1340	1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
PID 1356 wrote to memory of 1340	1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
PID 1356 wrote to memory of 1340	1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
PID 1356 wrote to memory of 1340	1356	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
PID 1340 wrote to memory of 1368	1340	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	WerFault.exe
PID 1340 wrote to memory of 1368	1340	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	WerFault.exe
PID 1340 wrote to memory of 1368	1340	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	WerFault.exe
PID 1340 wrote to memory of 1368	1340	eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
"C:\Users\Admin\AppData\Local\Temp\eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356

C:\Users\Admin\AppData\Local\Temp\eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
C:\Users\Admin\AppData\Local\Temp\eb544d2c62155cea869be4694b8e63b62021042898b89e4a2cd63d9b2c9d5181.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 564
3⤵
- Program crash
PID:1368

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-65-0x0000000000460000-0x0000000000463F00-memory.dmp

Filesize
15KB

Download
memory/1340-60-0x0000000000426B9E-mapping.dmp

Download
memory/1340-59-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1340-62-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1340-64-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1356-55-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1356-56-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1356-57-0x00000000074B0000-0x00000000075EC000-memory.dmp

Filesize
1.2MB

Download
memory/1356-58-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/1356-54-0x00000000009D0000-0x00000000009F4000-memory.dmp

Filesize
144KB

Download
memory/1356-66-0x0000000000545000-0x0000000000556000-memory.dmp

Filesize
68KB

Download
memory/1356-68-0x0000000000545000-0x0000000000556000-memory.dmp

Filesize
68KB

Download
memory/1368-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads