njrat | b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e

General

Target

a7c0c2333b7e07057647b6dcc1d0d5ac.exe
Size

95KB
MD5

a7c0c2333b7e07057647b6dcc1d0d5ac
SHA1

d8f3b54f4586ac682a013650f4350b4c9a9955a7
SHA256

b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e
SHA512

3c3c589896c3fc98165b56dcb5c02344c228ce023e9fc0b4da8bd21a7be78c081b1a5676067d7a279772ac99aa4e00144eb5abc12632f1a2afc3e60c271b62c2
SSDEEP

1536:6pvTI4X0UkJ2fe8o2VLWjOnZvU6l2MBnlLn/aaAqMnjkP:6pvE4uJ2Q2kFOZhZP

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4084 netsh.exe

pid	process
4084	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a7c0c2333b7e07057647b6dcc1d0d5ac.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	a7c0c2333b7e07057647b6dcc1d0d5ac.exe

Drops startup file 2 IoCs

Processes:

taskmgr.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\151fd47f794ef2318b946b794bcd6603.exe	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\151fd47f794ef2318b946b794bcd6603.exe	taskmgr.exe

Executes dropped EXE 1 IoCs

Processes:

taskmgr.exe

pid process

3900 taskmgr.exe

pid	process
3900	taskmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

taskmgr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\151fd47f794ef2318b946b794bcd6603 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\151fd47f794ef2318b946b794bcd6603 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmgr.exe\" .."	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe
Token: 33	3900	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3900	taskmgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a7c0c2333b7e07057647b6dcc1d0d5ac.exetaskmgr.exe

description	pid	process	target process
PID 1728 wrote to memory of 3900	1728	a7c0c2333b7e07057647b6dcc1d0d5ac.exe	taskmgr.exe
PID 1728 wrote to memory of 3900	1728	a7c0c2333b7e07057647b6dcc1d0d5ac.exe	taskmgr.exe
PID 1728 wrote to memory of 3900	1728	a7c0c2333b7e07057647b6dcc1d0d5ac.exe	taskmgr.exe
PID 3900 wrote to memory of 4084	3900	taskmgr.exe	netsh.exe
PID 3900 wrote to memory of 4084	3900	taskmgr.exe	netsh.exe
PID 3900 wrote to memory of 4084	3900	taskmgr.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\a7c0c2333b7e07057647b6dcc1d0d5ac.exe
"C:\Users\Admin\AppData\Local\Temp\a7c0c2333b7e07057647b6dcc1d0d5ac.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
"C:\Users\Admin\AppData\Local\Temp\taskmgr.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskmgr.exe" "taskmgr.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:4084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
Filesize
95KB

MD5
a7c0c2333b7e07057647b6dcc1d0d5ac

SHA1
d8f3b54f4586ac682a013650f4350b4c9a9955a7

SHA256
b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e

SHA512
3c3c589896c3fc98165b56dcb5c02344c228ce023e9fc0b4da8bd21a7be78c081b1a5676067d7a279772ac99aa4e00144eb5abc12632f1a2afc3e60c271b62c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
Filesize
95KB

MD5
a7c0c2333b7e07057647b6dcc1d0d5ac

SHA1
d8f3b54f4586ac682a013650f4350b4c9a9955a7

SHA256
b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e

SHA512
3c3c589896c3fc98165b56dcb5c02344c228ce023e9fc0b4da8bd21a7be78c081b1a5676067d7a279772ac99aa4e00144eb5abc12632f1a2afc3e60c271b62c2

Download Submit
memory/1728-132-0x0000000000EA0000-0x0000000000EBE000-memory.dmp

Filesize
120KB

Download
memory/1728-133-0x0000000005870000-0x000000000590C000-memory.dmp

Filesize
624KB

Download
memory/1728-134-0x0000000005EC0000-0x0000000006464000-memory.dmp

Filesize
5.6MB

Download
memory/1728-135-0x00000000059B0000-0x0000000005A42000-memory.dmp

Filesize
584KB

Download
memory/1728-136-0x0000000005910000-0x000000000591A000-memory.dmp

Filesize
40KB

Download
memory/1728-137-0x0000000005BA0000-0x0000000005BF6000-memory.dmp

Filesize
344KB

Download
memory/3900-138-0x0000000000000000-mapping.dmp

Download
memory/4084-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads