njrat | 86638771fc9716d996c0ad6b25403eaf2b5f03059954c496fddf57092997c53d

Analysis

max time kernel
32s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2023, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payload.exe
Size

100.1MB
MD5

22a3e7b5b88e3879c056c8769b9cb03a
SHA1

83ff230fc810b98072d07473d15695f3aab5ffc3
SHA256

86638771fc9716d996c0ad6b25403eaf2b5f03059954c496fddf57092997c53d
SHA512

242f205e3a10cf0667c6226303a0773f38c4ff152dc133edb793c3009ae4d914f34c03aea09f6d36f149f92c74ea06690176c28b55d88b1758b12197074f6880
SSDEEP

1536:D0DgDnPoNs3SO1EtrDPwsNMDHXExI3pmBm:AgDn3iO1erDPwsNMDHXExI3pm

Score

10^/10

njrat victim trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

0.tcp.eu.ngrok.io:10483

Mutex

8958e12cf41da683c650e52f5d78a5ad

Attributes

reg_key
8958e12cf41da683c650e52f5d78a5ad
splitter
Y262SUCZ4UJJ

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
220	Systemlog.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Payload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1676	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	Systemlog.exe
Token: 33	220	Systemlog.exe
Token: SeIncBasePriorityPrivilege	220	Systemlog.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 220	628	Payload.exe	88
PID 628 wrote to memory of 220	628	Payload.exe	88
PID 628 wrote to memory of 220	628	Payload.exe	88
PID 220 wrote to memory of 3924	220	Systemlog.exe	91
PID 220 wrote to memory of 3924	220	Systemlog.exe	91
PID 220 wrote to memory of 3924	220	Systemlog.exe	91
PID 220 wrote to memory of 5096	220	Systemlog.exe	93
PID 220 wrote to memory of 5096	220	Systemlog.exe	93
PID 220 wrote to memory of 5096	220	Systemlog.exe	93
PID 220 wrote to memory of 1676	220	Systemlog.exe	95
PID 220 wrote to memory of 1676	220	Systemlog.exe	95
PID 220 wrote to memory of 1676	220	Systemlog.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3924	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Roaming\Systemlog.exe
  "C:\Users\Admin\AppData\Roaming\Systemlog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Roaming\Systemlog.exe"
    3⤵
    - Views/modifies file attributes
    PID:3924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn CleanSweepCheck /f
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn CleanSweepCheck /tr C:\Users\Admin\AppData\Roaming\Systemlog.exe
    3⤵
    - Creates scheduled task(s)
    PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Systemlog.exe

Filesize
100.1MB

MD5
22a3e7b5b88e3879c056c8769b9cb03a

SHA1
83ff230fc810b98072d07473d15695f3aab5ffc3

SHA256
86638771fc9716d996c0ad6b25403eaf2b5f03059954c496fddf57092997c53d

SHA512
242f205e3a10cf0667c6226303a0773f38c4ff152dc133edb793c3009ae4d914f34c03aea09f6d36f149f92c74ea06690176c28b55d88b1758b12197074f6880

Download Submit
C:\Users\Admin\AppData\Roaming\Systemlog.exe

Filesize
100.1MB

MD5
22a3e7b5b88e3879c056c8769b9cb03a

SHA1
83ff230fc810b98072d07473d15695f3aab5ffc3

SHA256
86638771fc9716d996c0ad6b25403eaf2b5f03059954c496fddf57092997c53d

SHA512
242f205e3a10cf0667c6226303a0773f38c4ff152dc133edb793c3009ae4d914f34c03aea09f6d36f149f92c74ea06690176c28b55d88b1758b12197074f6880

Download Submit
memory/220-137-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/220-141-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/628-132-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/628-136-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads