njrat | b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e

General

Target

a7c0c2333b7e07057647b6dcc1d0d5ac.exe
Size

95KB
MD5

a7c0c2333b7e07057647b6dcc1d0d5ac
SHA1

d8f3b54f4586ac682a013650f4350b4c9a9955a7
SHA256

b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e
SHA512

3c3c589896c3fc98165b56dcb5c02344c228ce023e9fc0b4da8bd21a7be78c081b1a5676067d7a279772ac99aa4e00144eb5abc12632f1a2afc3e60c271b62c2
SSDEEP

1536:6pvTI4X0UkJ2fe8o2VLWjOnZvU6l2MBnlLn/aaAqMnjkP:6pvE4uJ2Q2kFOZhZP

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

gololosd.ddns.net:9090

Mutex

151fd47f794ef2318b946b794bcd6603

Attributes

reg_key
151fd47f794ef2318b946b794bcd6603
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1920 netsh.exe

pid	process
1920	netsh.exe

Drops startup file 2 IoCs

Processes:

taskmgr.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\151fd47f794ef2318b946b794bcd6603.exe	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\151fd47f794ef2318b946b794bcd6603.exe	taskmgr.exe

Executes dropped EXE 1 IoCs

Processes:

taskmgr.exe

pid process

1324 taskmgr.exe
Loads dropped DLL 1 IoCs

Processes:

a7c0c2333b7e07057647b6dcc1d0d5ac.exe

pid process

1244 a7c0c2333b7e07057647b6dcc1d0d5ac.exe

pid	process
1324	taskmgr.exe

pid	process
1244	a7c0c2333b7e07057647b6dcc1d0d5ac.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

taskmgr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\151fd47f794ef2318b946b794bcd6603 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\151fd47f794ef2318b946b794bcd6603 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe
Token: 33	1324	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1324	taskmgr.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a7c0c2333b7e07057647b6dcc1d0d5ac.exetaskmgr.exe

description	pid	process	target process
PID 1244 wrote to memory of 1324	1244	a7c0c2333b7e07057647b6dcc1d0d5ac.exe	taskmgr.exe
PID 1244 wrote to memory of 1324	1244	a7c0c2333b7e07057647b6dcc1d0d5ac.exe	taskmgr.exe
PID 1244 wrote to memory of 1324	1244	a7c0c2333b7e07057647b6dcc1d0d5ac.exe	taskmgr.exe
PID 1244 wrote to memory of 1324	1244	a7c0c2333b7e07057647b6dcc1d0d5ac.exe	taskmgr.exe
PID 1324 wrote to memory of 1920	1324	taskmgr.exe	netsh.exe
PID 1324 wrote to memory of 1920	1324	taskmgr.exe	netsh.exe
PID 1324 wrote to memory of 1920	1324	taskmgr.exe	netsh.exe
PID 1324 wrote to memory of 1920	1324	taskmgr.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\a7c0c2333b7e07057647b6dcc1d0d5ac.exe
"C:\Users\Admin\AppData\Local\Temp\a7c0c2333b7e07057647b6dcc1d0d5ac.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
"C:\Users\Admin\AppData\Local\Temp\taskmgr.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskmgr.exe" "taskmgr.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
Filesize
95KB

MD5
a7c0c2333b7e07057647b6dcc1d0d5ac

SHA1
d8f3b54f4586ac682a013650f4350b4c9a9955a7

SHA256
b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e

SHA512
3c3c589896c3fc98165b56dcb5c02344c228ce023e9fc0b4da8bd21a7be78c081b1a5676067d7a279772ac99aa4e00144eb5abc12632f1a2afc3e60c271b62c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
Filesize
95KB

MD5
a7c0c2333b7e07057647b6dcc1d0d5ac

SHA1
d8f3b54f4586ac682a013650f4350b4c9a9955a7

SHA256
b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e

SHA512
3c3c589896c3fc98165b56dcb5c02344c228ce023e9fc0b4da8bd21a7be78c081b1a5676067d7a279772ac99aa4e00144eb5abc12632f1a2afc3e60c271b62c2

Download Submit
\Users\Admin\AppData\Local\Temp\taskmgr.exe
Filesize
95KB

MD5
a7c0c2333b7e07057647b6dcc1d0d5ac

SHA1
d8f3b54f4586ac682a013650f4350b4c9a9955a7

SHA256
b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e

SHA512
3c3c589896c3fc98165b56dcb5c02344c228ce023e9fc0b4da8bd21a7be78c081b1a5676067d7a279772ac99aa4e00144eb5abc12632f1a2afc3e60c271b62c2

Download Submit
memory/1244-54-0x0000000000BB0000-0x0000000000BCE000-memory.dmp

Filesize
120KB

Download
memory/1244-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download
memory/1244-56-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/1244-57-0x0000000000485000-0x0000000000496000-memory.dmp

Filesize
68KB

Download
memory/1324-59-0x0000000000000000-mapping.dmp

Download
memory/1324-62-0x0000000000830000-0x000000000084E000-memory.dmp

Filesize
120KB

Download
memory/1324-64-0x0000000004D15000-0x0000000004D26000-memory.dmp

Filesize
68KB

Download
memory/1920-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads