njrat | d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d

General

Target

1a32989d5a4f6d15588242f1ef8a22d8.exe
Size

23KB
MD5

1a32989d5a4f6d15588242f1ef8a22d8
SHA1

02d933d2513fa70a46ca89082027752b6db2d899
SHA256

d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d
SHA512

cff44db241af8b3decd1857a90dffdb6d0d6f7518b95dd931422596bb03d0ffbb9cb1ec0d129d61cc514742e74c4ca547d2bfa6286fa31647577de3e5ee79620
SSDEEP

384:cDQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZcDq:cU5yBVd7Rpcnu2

Score

10^/10

njrat lammer evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

C2

donaldsvip1234.ddns.net:1177

Mutex

b37250e28d5e084b62b0aec8b915940b

Attributes

reg_key
b37250e28d5e084b62b0aec8b915940b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Trojan.exe

pid process

1160 Trojan.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2040 netsh.exe

pid	process
1160	Trojan.exe

pid	process
2040	netsh.exe

Drops startup file 2 IoCs

Processes:

Trojan.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b37250e28d5e084b62b0aec8b915940b.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b37250e28d5e084b62b0aec8b915940b.exe	Trojan.exe

Loads dropped DLL 1 IoCs

Processes:

1a32989d5a4f6d15588242f1ef8a22d8.exe

pid process

1424 1a32989d5a4f6d15588242f1ef8a22d8.exe

pid	process
1424	1a32989d5a4f6d15588242f1ef8a22d8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Trojan.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\b37250e28d5e084b62b0aec8b915940b = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b37250e28d5e084b62b0aec8b915940b = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .."	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

Trojan.exe

description	pid	process
Token: SeDebugPrivilege	1160	Trojan.exe
Token: 33	1160	Trojan.exe
Token: SeIncBasePriorityPrivilege	1160	Trojan.exe
Token: 33	1160	Trojan.exe
Token: SeIncBasePriorityPrivilege	1160	Trojan.exe
Token: 33	1160	Trojan.exe
Token: SeIncBasePriorityPrivilege	1160	Trojan.exe
Token: 33	1160	Trojan.exe
Token: SeIncBasePriorityPrivilege	1160	Trojan.exe
Token: 33	1160	Trojan.exe
Token: SeIncBasePriorityPrivilege	1160	Trojan.exe
Token: 33	1160	Trojan.exe
Token: SeIncBasePriorityPrivilege	1160	Trojan.exe
Token: 33	1160	Trojan.exe
Token: SeIncBasePriorityPrivilege	1160	Trojan.exe
Token: 33	1160	Trojan.exe
Token: SeIncBasePriorityPrivilege	1160	Trojan.exe
Token: 33	1160	Trojan.exe
Token: SeIncBasePriorityPrivilege	1160	Trojan.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1a32989d5a4f6d15588242f1ef8a22d8.exeTrojan.exe

description	pid	process	target process
PID 1424 wrote to memory of 1160	1424	1a32989d5a4f6d15588242f1ef8a22d8.exe	Trojan.exe
PID 1424 wrote to memory of 1160	1424	1a32989d5a4f6d15588242f1ef8a22d8.exe	Trojan.exe
PID 1424 wrote to memory of 1160	1424	1a32989d5a4f6d15588242f1ef8a22d8.exe	Trojan.exe
PID 1424 wrote to memory of 1160	1424	1a32989d5a4f6d15588242f1ef8a22d8.exe	Trojan.exe
PID 1160 wrote to memory of 2040	1160	Trojan.exe	netsh.exe
PID 1160 wrote to memory of 2040	1160	Trojan.exe	netsh.exe
PID 1160 wrote to memory of 2040	1160	Trojan.exe	netsh.exe
PID 1160 wrote to memory of 2040	1160	Trojan.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\1a32989d5a4f6d15588242f1ef8a22d8.exe
"C:\Users\Admin\AppData\Local\Temp\1a32989d5a4f6d15588242f1ef8a22d8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1424

C:\Users\Admin\AppData\Roaming\Trojan.exe
"C:\Users\Admin\AppData\Roaming\Trojan.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Trojan.exe" "Trojan.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Trojan.exe
Filesize
23KB

MD5
1a32989d5a4f6d15588242f1ef8a22d8

SHA1
02d933d2513fa70a46ca89082027752b6db2d899

SHA256
d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d

SHA512
cff44db241af8b3decd1857a90dffdb6d0d6f7518b95dd931422596bb03d0ffbb9cb1ec0d129d61cc514742e74c4ca547d2bfa6286fa31647577de3e5ee79620

Download Submit
C:\Users\Admin\AppData\Roaming\Trojan.exe
Filesize
23KB

MD5
1a32989d5a4f6d15588242f1ef8a22d8

SHA1
02d933d2513fa70a46ca89082027752b6db2d899

SHA256
d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d

SHA512
cff44db241af8b3decd1857a90dffdb6d0d6f7518b95dd931422596bb03d0ffbb9cb1ec0d129d61cc514742e74c4ca547d2bfa6286fa31647577de3e5ee79620

Download Submit
\Users\Admin\AppData\Roaming\Trojan.exe
Filesize
23KB

MD5
1a32989d5a4f6d15588242f1ef8a22d8

SHA1
02d933d2513fa70a46ca89082027752b6db2d899

SHA256
d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d

SHA512
cff44db241af8b3decd1857a90dffdb6d0d6f7518b95dd931422596bb03d0ffbb9cb1ec0d129d61cc514742e74c4ca547d2bfa6286fa31647577de3e5ee79620

Download Submit
memory/1160-57-0x0000000000000000-mapping.dmp

Download
memory/1160-61-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/1160-65-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/1424-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1424-55-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/1424-62-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads