njrat | 02175550330b76de111ae886a542242298c5b50b26f5d49a520fbe1481e52aab

General

Target

Server.exe
Size

37KB
MD5

77a061d54196511fb985ad08f61b4681
SHA1

e783b16bf42144aac4acf441fce87415e0dca275
SHA256

02175550330b76de111ae886a542242298c5b50b26f5d49a520fbe1481e52aab
SHA512

0292ebd71c561c6ad5ed841ba63e85b4606fd8c612eeb6d925a4e66933da19b3241569c3ce21b6451cf7eced02b0dea8e6893b2511ed041fdaf141052d9c3086
SSDEEP

384:calayyaik9hkdTnNiybYT81PRsc4jWj7rAF+rMRTyN/0L+EcoinblneHQM3epzX6:NgyCxNxbYT81y1WHrM+rMRa8Nu4Bt

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

considered-arrest.at.ply.gg:19159

Mutex

8b1b4ed3028d60637b47ebe2ea5ce8d7

Attributes

reg_key
8b1b4ed3028d60637b47ebe2ea5ce8d7
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

752 netsh.exe

pid	process
752	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Server.exeRuntime Broker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe

Executes dropped EXE 1 IoCs

Processes:

Runtime Broker.exe

pid process

1444 Runtime Broker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

5104 reg.exe

pid	process
1444	Runtime Broker.exe

pid	process
5104	reg.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

Runtime Broker.exe

description	pid	process
Token: SeDebugPrivilege	1444	Runtime Broker.exe
Token: 33	1444	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1444	Runtime Broker.exe
Token: 33	1444	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1444	Runtime Broker.exe
Token: 33	1444	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1444	Runtime Broker.exe
Token: 33	1444	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1444	Runtime Broker.exe
Token: 33	1444	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1444	Runtime Broker.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Server.exeRuntime Broker.execmd.exe

description	pid	process	target process
PID 5016 wrote to memory of 1444	5016	Server.exe	Runtime Broker.exe
PID 5016 wrote to memory of 1444	5016	Server.exe	Runtime Broker.exe
PID 5016 wrote to memory of 1444	5016	Server.exe	Runtime Broker.exe
PID 1444 wrote to memory of 752	1444	Runtime Broker.exe	netsh.exe
PID 1444 wrote to memory of 752	1444	Runtime Broker.exe	netsh.exe
PID 1444 wrote to memory of 752	1444	Runtime Broker.exe	netsh.exe
PID 1444 wrote to memory of 4888	1444	Runtime Broker.exe	cmd.exe
PID 1444 wrote to memory of 4888	1444	Runtime Broker.exe	cmd.exe
PID 1444 wrote to memory of 4888	1444	Runtime Broker.exe	cmd.exe
PID 4888 wrote to memory of 5104	4888	cmd.exe	reg.exe
PID 4888 wrote to memory of 5104	4888	cmd.exe	reg.exe
PID 4888 wrote to memory of 5104	4888	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5016

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" "Runtime Broker.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp908.tmp.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\SysWOW64\reg.exe
REG add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:5104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp908.tmp.bat
Filesize
109B

MD5
c8e1c290640046814ab4e6fd65eb372b

SHA1
ca18c9fb819873e0f60b978708bc50a47f81a0ae

SHA256
cb7f932b08cebf30383abbf8fdd4b2c47cbeb31f4876827bc24b0e0b4acdea53

SHA512
12a2f980af8b1a1c65f05d05dd8129281f1135d143cf0ab904a7ab09775532aafa48f9ed395de134c3fb4a621dee71ccf709af931806609905ecc2e51ec4d994

Download Submit
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
Filesize
37KB

MD5
77a061d54196511fb985ad08f61b4681

SHA1
e783b16bf42144aac4acf441fce87415e0dca275

SHA256
02175550330b76de111ae886a542242298c5b50b26f5d49a520fbe1481e52aab

SHA512
0292ebd71c561c6ad5ed841ba63e85b4606fd8c612eeb6d925a4e66933da19b3241569c3ce21b6451cf7eced02b0dea8e6893b2511ed041fdaf141052d9c3086

Download Submit
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
Filesize
37KB

MD5
77a061d54196511fb985ad08f61b4681

SHA1
e783b16bf42144aac4acf441fce87415e0dca275

SHA256
02175550330b76de111ae886a542242298c5b50b26f5d49a520fbe1481e52aab

SHA512
0292ebd71c561c6ad5ed841ba63e85b4606fd8c612eeb6d925a4e66933da19b3241569c3ce21b6451cf7eced02b0dea8e6893b2511ed041fdaf141052d9c3086

Download Submit
memory/752-138-0x0000000000000000-mapping.dmp

Download
memory/1444-133-0x0000000000000000-mapping.dmp

Download
memory/1444-137-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download
memory/1444-139-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download
memory/4888-140-0x0000000000000000-mapping.dmp

Download
memory/5016-132-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download
memory/5016-136-0x0000000074E50000-0x0000000075401000-memory.dmp

Filesize
5.7MB

Download
memory/5104-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads