njrat | e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd.exe
Size

2.7MB
MD5

aeaea6351755710c58f417cb3950fa2c
SHA1

f70dd0ef55453aab682d9e7e7efb87c690160a9d
SHA256

e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd
SHA512

8f25389fdf030c6e432fffb73920f7c00bb4343c5f96e7c14743b277edf34f94ee40001912837f268d7191f1b6918d6c21e44d34e95eb6bdf673fd81b95af6ee
SSDEEP

49152:dJZoQrbTFZY1iacKz58Fcw8uaFKnS3Ubv/Ukd1Zau86XwNjI+zJD9PEe7M:dtrbTA1jr8smMkdDd86XwJXdd7M

Score

10^/10

njrat jøoker ħäằäckèr evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

JØoker ĦäằäCkèr

hsn85.no-ip.biz:555

Mutex

8100c3226482ae95a43914b125e72414

Attributes

reg_key
8100c3226482ae95a43914b125e72414
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 4 IoCs

pid	Process
4356	System.exe
2368	Setup_FacebookPasswordHack 2014.exe
2760	TempNajaf.exe
4236	Update.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
3260	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	TempNajaf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	System.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	Setup_FacebookPasswordHack 2014.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8100c3226482ae95a43914b125e72414 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.exe\" .."	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8100c3226482ae95a43914b125e72414 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.exe\" .."	Update.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	System.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	System.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0006000000022f71-135.dat	nsis_installer_1
behavioral2/files/0x0006000000022f71-135.dat	nsis_installer_2
behavioral2/files/0x0006000000022f71-136.dat	nsis_installer_1
behavioral2/files/0x0006000000022f71-136.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe
4356	System.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4356	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	System.exe
Token: SeDebugPrivilege	4236	Update.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 4356	3096	e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd.exe	80
PID 3096 wrote to memory of 4356	3096	e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd.exe	80
PID 3096 wrote to memory of 4356	3096	e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd.exe	80
PID 3096 wrote to memory of 2368	3096	e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd.exe	81
PID 3096 wrote to memory of 2368	3096	e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd.exe	81
PID 3096 wrote to memory of 2368	3096	e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd.exe	81
PID 4356 wrote to memory of 2760	4356	System.exe	84
PID 4356 wrote to memory of 2760	4356	System.exe	84
PID 4356 wrote to memory of 2760	4356	System.exe	84
PID 2760 wrote to memory of 4236	2760	TempNajaf.exe	85
PID 2760 wrote to memory of 4236	2760	TempNajaf.exe	85
PID 2760 wrote to memory of 4236	2760	TempNajaf.exe	85
PID 4236 wrote to memory of 3260	4236	Update.exe	86
PID 4236 wrote to memory of 3260	4236	Update.exe	86
PID 4236 wrote to memory of 3260	4236	Update.exe	86

C:\Users\Admin\AppData\Local\Temp\e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd.exe
"C:\Users\Admin\AppData\Local\Temp\e8648c12edb71ba951b2306a7b235dbdc474f26e33319e8ba7219e4a50dd99bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Temp\System.exe
  C:\Users\Admin\AppData\Local\Temp/System.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Local\TempNajaf.exe
    "C:\Users\Admin\AppData\Local\TempNajaf.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Update.exe
      "C:\Users\Admin\AppData\Local\Temp\Update.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Update.exe" "Update.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:3260
- C:\Users\Admin\AppData\Local\Temp\Setup_FacebookPasswordHack 2014.exe
  "C:\Users\Admin\AppData\Local\Temp/Setup_FacebookPasswordHack 2014.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\TempNajaf.exe

Filesize
29KB

MD5
d9ed25466a77bc9106d5dedf76292e47

SHA1
ea583053caca2e0fa7187cab072dad3affa3a5d9

SHA256
755b1e8ec6fa24ffc9cd18dfca43dce46f05abd236e34b1cd16af9522b8a7989

SHA512
6de60891f5ae3ac2148b348c82d79b0d205cc7ed838616e5f73c2c25e9fd823d8b1475a87d688c895d27a02265dbe5b6053f54df73932455371997f00f50c485

Download Submit
C:\Users\Admin\AppData\Local\TempNajaf.exe

Filesize
29KB

MD5
d9ed25466a77bc9106d5dedf76292e47

SHA1
ea583053caca2e0fa7187cab072dad3affa3a5d9

SHA256
755b1e8ec6fa24ffc9cd18dfca43dce46f05abd236e34b1cd16af9522b8a7989

SHA512
6de60891f5ae3ac2148b348c82d79b0d205cc7ed838616e5f73c2c25e9fd823d8b1475a87d688c895d27a02265dbe5b6053f54df73932455371997f00f50c485

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup_FacebookPasswordHack 2014.exe

Filesize
1.9MB

MD5
ee3ea9d01b1202549d0ea19da285eb68

SHA1
721027a19f98e12ef3c3d851875bde3827f3c496

SHA256
83bdd3882cfd3d5ac6a08ea79dc0be51d301300e03b23b7200881d3b690de8d5

SHA512
39f77797bc6840ad835319224f3dcd7cc200eb79d4b6fa3f15b72e9ea790bc29f6c0b552810a156d602414e38f4be11ca110cfb6ea4ae009d4f818150bdb702e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup_FacebookPasswordHack 2014.exe

Filesize
1.9MB

MD5
ee3ea9d01b1202549d0ea19da285eb68

SHA1
721027a19f98e12ef3c3d851875bde3827f3c496

SHA256
83bdd3882cfd3d5ac6a08ea79dc0be51d301300e03b23b7200881d3b690de8d5

SHA512
39f77797bc6840ad835319224f3dcd7cc200eb79d4b6fa3f15b72e9ea790bc29f6c0b552810a156d602414e38f4be11ca110cfb6ea4ae009d4f818150bdb702e

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
53KB

MD5
6cf518f1d8ad355c81a88efb28b69295

SHA1
661136e0c9b252f61d12f14d854fc32688ccce13

SHA256
3c8d24ac4e77862e89e74732d94b37b2bf776610b5ed26634256ea96dd0322fc

SHA512
cbd3522d154c05251e3930d4694ce8f34f7dfc2b72b032107850ab891912c114286dfa7d88224e217a3b1fb3f20aa2c857323b214feabb760e954b5f5be12366

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
53KB

MD5
6cf518f1d8ad355c81a88efb28b69295

SHA1
661136e0c9b252f61d12f14d854fc32688ccce13

SHA256
3c8d24ac4e77862e89e74732d94b37b2bf776610b5ed26634256ea96dd0322fc

SHA512
cbd3522d154c05251e3930d4694ce8f34f7dfc2b72b032107850ab891912c114286dfa7d88224e217a3b1fb3f20aa2c857323b214feabb760e954b5f5be12366

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
29KB

MD5
d9ed25466a77bc9106d5dedf76292e47

SHA1
ea583053caca2e0fa7187cab072dad3affa3a5d9

SHA256
755b1e8ec6fa24ffc9cd18dfca43dce46f05abd236e34b1cd16af9522b8a7989

SHA512
6de60891f5ae3ac2148b348c82d79b0d205cc7ed838616e5f73c2c25e9fd823d8b1475a87d688c895d27a02265dbe5b6053f54df73932455371997f00f50c485

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
29KB

MD5
d9ed25466a77bc9106d5dedf76292e47

SHA1
ea583053caca2e0fa7187cab072dad3affa3a5d9

SHA256
755b1e8ec6fa24ffc9cd18dfca43dce46f05abd236e34b1cd16af9522b8a7989

SHA512
6de60891f5ae3ac2148b348c82d79b0d205cc7ed838616e5f73c2c25e9fd823d8b1475a87d688c895d27a02265dbe5b6053f54df73932455371997f00f50c485

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslFC96.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
memory/2760-146-0x0000000074650000-0x0000000074C01000-memory.dmp

Filesize
5.7MB

Download
memory/2760-151-0x0000000074650000-0x0000000074C01000-memory.dmp

Filesize
5.7MB

Download
memory/4236-147-0x0000000074650000-0x0000000074C01000-memory.dmp

Filesize
5.7MB

Download
memory/4236-152-0x0000000074650000-0x0000000074C01000-memory.dmp

Filesize
5.7MB

Download
memory/4356-138-0x0000000074650000-0x0000000074C01000-memory.dmp

Filesize
5.7MB

Download
memory/4356-148-0x0000000074650000-0x0000000074C01000-memory.dmp

Filesize
5.7MB

Download
memory/4356-150-0x0000000074650000-0x0000000074C01000-memory.dmp

Filesize
5.7MB

Download