njrat | d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d

General

Target

1a32989d5a4f6d15588242f1ef8a22d8.exe
Size

23KB
MD5

1a32989d5a4f6d15588242f1ef8a22d8
SHA1

02d933d2513fa70a46ca89082027752b6db2d899
SHA256

d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d
SHA512

cff44db241af8b3decd1857a90dffdb6d0d6f7518b95dd931422596bb03d0ffbb9cb1ec0d129d61cc514742e74c4ca547d2bfa6286fa31647577de3e5ee79620
SSDEEP

384:cDQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZcDq:cU5yBVd7Rpcnu2

Score

10^/10

njrat lammer evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

C2

donaldsvip1234.ddns.net:1177

Mutex

b37250e28d5e084b62b0aec8b915940b

Attributes

reg_key
b37250e28d5e084b62b0aec8b915940b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Trojan.exe

pid process

2004 Trojan.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

5020 netsh.exe

pid	process
2004	Trojan.exe

pid	process
5020	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1a32989d5a4f6d15588242f1ef8a22d8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1a32989d5a4f6d15588242f1ef8a22d8.exe

Drops startup file 2 IoCs

Processes:

Trojan.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b37250e28d5e084b62b0aec8b915940b.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b37250e28d5e084b62b0aec8b915940b.exe	Trojan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Trojan.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b37250e28d5e084b62b0aec8b915940b = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b37250e28d5e084b62b0aec8b915940b = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .."	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

Trojan.exe

description	pid	process
Token: SeDebugPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe
Token: 33	2004	Trojan.exe
Token: SeIncBasePriorityPrivilege	2004	Trojan.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1a32989d5a4f6d15588242f1ef8a22d8.exeTrojan.exe

description	pid	process	target process
PID 4736 wrote to memory of 2004	4736	1a32989d5a4f6d15588242f1ef8a22d8.exe	Trojan.exe
PID 4736 wrote to memory of 2004	4736	1a32989d5a4f6d15588242f1ef8a22d8.exe	Trojan.exe
PID 4736 wrote to memory of 2004	4736	1a32989d5a4f6d15588242f1ef8a22d8.exe	Trojan.exe
PID 2004 wrote to memory of 5020	2004	Trojan.exe	netsh.exe
PID 2004 wrote to memory of 5020	2004	Trojan.exe	netsh.exe
PID 2004 wrote to memory of 5020	2004	Trojan.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\1a32989d5a4f6d15588242f1ef8a22d8.exe
"C:\Users\Admin\AppData\Local\Temp\1a32989d5a4f6d15588242f1ef8a22d8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4736

C:\Users\Admin\AppData\Roaming\Trojan.exe
"C:\Users\Admin\AppData\Roaming\Trojan.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Trojan.exe" "Trojan.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:5020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Trojan.exe
Filesize
23KB

MD5
1a32989d5a4f6d15588242f1ef8a22d8

SHA1
02d933d2513fa70a46ca89082027752b6db2d899

SHA256
d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d

SHA512
cff44db241af8b3decd1857a90dffdb6d0d6f7518b95dd931422596bb03d0ffbb9cb1ec0d129d61cc514742e74c4ca547d2bfa6286fa31647577de3e5ee79620

Download Submit
C:\Users\Admin\AppData\Roaming\Trojan.exe
Filesize
23KB

MD5
1a32989d5a4f6d15588242f1ef8a22d8

SHA1
02d933d2513fa70a46ca89082027752b6db2d899

SHA256
d10d2da128b79ed62720da7dd3bf03a72519d755575ec4b0b18c51b1b0879c5d

SHA512
cff44db241af8b3decd1857a90dffdb6d0d6f7518b95dd931422596bb03d0ffbb9cb1ec0d129d61cc514742e74c4ca547d2bfa6286fa31647577de3e5ee79620

Download Submit
memory/2004-133-0x0000000000000000-mapping.dmp

Download
memory/2004-137-0x0000000074ED0000-0x0000000075481000-memory.dmp

Filesize
5.7MB

Download
memory/2004-139-0x0000000074ED0000-0x0000000075481000-memory.dmp

Filesize
5.7MB

Download
memory/4736-132-0x0000000074ED0000-0x0000000075481000-memory.dmp

Filesize
5.7MB

Download
memory/4736-136-0x0000000074ED0000-0x0000000075481000-memory.dmp

Filesize
5.7MB

Download
memory/5020-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads