njrat | cc902803f8374f3f386b3537b86202b2f3c5557e9df541128a7b333c1db75f46

General

Target

0x000600000001ace7-182.exe
Size

26KB
MD5

921d7c2187427974a52b164873636bc3
SHA1

e8e3d80fa107c613a537bfabd6d6cd997d259928
SHA256

cc902803f8374f3f386b3537b86202b2f3c5557e9df541128a7b333c1db75f46
SHA512

ce1e6411f47f2961b150488b4c3f4dcfc9cf4e98a7a2e46a9855dd9e2ee33ba7e0e2644bde187635efb2d15d17bfb2da7e162cffa9fc7445da990d76f11f09a9
SSDEEP

384:TLo5FonO4Y1JVpMrI0CxPzdxRMkAQk93vmhm7UMKmIEecKdbXTzm9bVhca06Mr6s:3uZ/utkA/vMHTi9bD

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

C2

carolina-electro.at.ply.gg:23401

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	0x000600000001ace7-182.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	0x000600000001ace7-182.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	0x000600000001ace7-182.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	attrib.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	0x000600000001ace7-182.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	0x000600000001ace7-182.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	0x000600000001ace7-182.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	0x000600000001ace7-182.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	0x000600000001ace7-182.exe
Token: 33	1928	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	1928	0x000600000001ace7-182.exe
Token: 33	1928	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	1928	0x000600000001ace7-182.exe
Token: 33	1928	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	1928	0x000600000001ace7-182.exe
Token: 33	1928	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	1928	0x000600000001ace7-182.exe
Token: 33	1928	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	1928	0x000600000001ace7-182.exe
Token: 33	1928	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	1928	0x000600000001ace7-182.exe
Token: 33	1928	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	1928	0x000600000001ace7-182.exe
Token: 33	1928	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	1928	0x000600000001ace7-182.exe
Token: 33	1928	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	1928	0x000600000001ace7-182.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1364	1928	0x000600000001ace7-182.exe	28
PID 1928 wrote to memory of 1364	1928	0x000600000001ace7-182.exe	28
PID 1928 wrote to memory of 1364	1928	0x000600000001ace7-182.exe	28
PID 1928 wrote to memory of 1364	1928	0x000600000001ace7-182.exe	28
PID 1928 wrote to memory of 1280	1928	0x000600000001ace7-182.exe	30
PID 1928 wrote to memory of 1280	1928	0x000600000001ace7-182.exe	30
PID 1928 wrote to memory of 1280	1928	0x000600000001ace7-182.exe	30
PID 1928 wrote to memory of 1280	1928	0x000600000001ace7-182.exe	30

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1280	attrib.exe
1364	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0x000600000001ace7-182.exe
"C:\Users\Admin\AppData\Local\Temp\0x000600000001ace7-182.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
  2⤵
  - Drops startup file
  - Views/modifies file attributes
  PID:1364
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
  2⤵
  - Views/modifies file attributes
  PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe

Filesize
26KB

MD5
921d7c2187427974a52b164873636bc3

SHA1
e8e3d80fa107c613a537bfabd6d6cd997d259928

SHA256
cc902803f8374f3f386b3537b86202b2f3c5557e9df541128a7b333c1db75f46

SHA512
ce1e6411f47f2961b150488b4c3f4dcfc9cf4e98a7a2e46a9855dd9e2ee33ba7e0e2644bde187635efb2d15d17bfb2da7e162cffa9fc7445da990d76f11f09a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe

Filesize
26KB

MD5
921d7c2187427974a52b164873636bc3

SHA1
e8e3d80fa107c613a537bfabd6d6cd997d259928

SHA256
cc902803f8374f3f386b3537b86202b2f3c5557e9df541128a7b333c1db75f46

SHA512
ce1e6411f47f2961b150488b4c3f4dcfc9cf4e98a7a2e46a9855dd9e2ee33ba7e0e2644bde187635efb2d15d17bfb2da7e162cffa9fc7445da990d76f11f09a9

Download Submit
memory/1928-54-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/1928-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads