njrat | 4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d

General

Target

4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe
Size

29KB
MD5

11ef3d97079782832221384140891230
SHA1

f1ea22af601045d1b4f46ddaddd07a07b878ecf6
SHA256

4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d
SHA512

06e13b9f9e2ae38fc280c30922ecdb79e15e16516334341ec25e5fc301d5a79091217ea4410e7a8263520c8424ce1826f99a6916481b3e49e8657cf8f0e37c22
SSDEEP

384:5yotl7bJdYQwiJYYHt5PgjmOmqDoFE4eoKGBsbh0w4wlAokw9OhgOL1vYRGOZz7E:P7/YQwiNGjAqc3eYBKh0p29SgRdu

Score

10^/10

njrat hacked by the bl@ck ghost evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed By The Bl@ck Ghost

C2

127.0.0.1:1177

Mutex

12ce4e06a81e8d54fd01d9b762f1b1bb

Attributes

reg_key
12ce4e06a81e8d54fd01d9b762f1b1bb
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

system.exe

pid process

916 system.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

520 netsh.exe
Loads dropped DLL 1 IoCs

Processes:

4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe

pid process

2016 4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
520	netsh.exe

pid	process
2016	4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

system.exe

pid	process
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe
916	system.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

system.exe

description pid process

Token: SeDebugPrivilege 916 system.exe

description	pid	process
Token: SeDebugPrivilege	916	system.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exesystem.exe

description	pid	process	target process
PID 2016 wrote to memory of 916	2016	4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe	system.exe
PID 2016 wrote to memory of 916	2016	4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe	system.exe
PID 2016 wrote to memory of 916	2016	4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe	system.exe
PID 2016 wrote to memory of 916	2016	4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe	system.exe
PID 916 wrote to memory of 520	916	system.exe	netsh.exe
PID 916 wrote to memory of 520	916	system.exe	netsh.exe
PID 916 wrote to memory of 520	916	system.exe	netsh.exe
PID 916 wrote to memory of 520	916	system.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe
"C:\Users\Admin\AppData\Local\Temp\4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\system.exe
"C:\Users\Admin\AppData\Local\Temp\system.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\system.exe" "system.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\system.exe
Filesize
29KB

MD5
11ef3d97079782832221384140891230

SHA1
f1ea22af601045d1b4f46ddaddd07a07b878ecf6

SHA256
4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d

SHA512
06e13b9f9e2ae38fc280c30922ecdb79e15e16516334341ec25e5fc301d5a79091217ea4410e7a8263520c8424ce1826f99a6916481b3e49e8657cf8f0e37c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe
Filesize
29KB

MD5
11ef3d97079782832221384140891230

SHA1
f1ea22af601045d1b4f46ddaddd07a07b878ecf6

SHA256
4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d

SHA512
06e13b9f9e2ae38fc280c30922ecdb79e15e16516334341ec25e5fc301d5a79091217ea4410e7a8263520c8424ce1826f99a6916481b3e49e8657cf8f0e37c22

Download Submit
\Users\Admin\AppData\Local\Temp\system.exe
Filesize
29KB

MD5
11ef3d97079782832221384140891230

SHA1
f1ea22af601045d1b4f46ddaddd07a07b878ecf6

SHA256
4c0ea2e9d02738b568a654d6eac8de4725fd09df22ee62e200dcaf6202a9d42d

SHA512
06e13b9f9e2ae38fc280c30922ecdb79e15e16516334341ec25e5fc301d5a79091217ea4410e7a8263520c8424ce1826f99a6916481b3e49e8657cf8f0e37c22

Download Submit
memory/520-62-0x0000000000000000-mapping.dmp

Download
memory/916-57-0x0000000000000000-mapping.dmp

Download
memory/916-64-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/916-65-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/2016-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/2016-55-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download
memory/2016-61-0x00000000749D0000-0x0000000074F7B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing