njrat | cc902803f8374f3f386b3537b86202b2f3c5557e9df541128a7b333c1db75f46

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2023, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0x000600000001ace7-182.exe
Size

26KB
MD5

921d7c2187427974a52b164873636bc3
SHA1

e8e3d80fa107c613a537bfabd6d6cd997d259928
SHA256

cc902803f8374f3f386b3537b86202b2f3c5557e9df541128a7b333c1db75f46
SHA512

ce1e6411f47f2961b150488b4c3f4dcfc9cf4e98a7a2e46a9855dd9e2ee33ba7e0e2644bde187635efb2d15d17bfb2da7e162cffa9fc7445da990d76f11f09a9
SSDEEP

384:TLo5FonO4Y1JVpMrI0CxPzdxRMkAQk93vmhm7UMKmIEecKdbXTzm9bVhca06Mr6s:3uZ/utkA/vMHTi9bD

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

carolina-electro.at.ply.gg:23401

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	0x000600000001ace7-182.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	0x000600000001ace7-182.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	0x000600000001ace7-182.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	attrib.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	0x000600000001ace7-182.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	0x000600000001ace7-182.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	0x000600000001ace7-182.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	0x000600000001ace7-182.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe
Token: 33	4884	0x000600000001ace7-182.exe
Token: SeIncBasePriorityPrivilege	4884	0x000600000001ace7-182.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4696	4884	0x000600000001ace7-182.exe	81
PID 4884 wrote to memory of 4696	4884	0x000600000001ace7-182.exe	81
PID 4884 wrote to memory of 4696	4884	0x000600000001ace7-182.exe	81
PID 4884 wrote to memory of 3544	4884	0x000600000001ace7-182.exe	82
PID 4884 wrote to memory of 3544	4884	0x000600000001ace7-182.exe	82
PID 4884 wrote to memory of 3544	4884	0x000600000001ace7-182.exe	82

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3544	attrib.exe
4696	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0x000600000001ace7-182.exe
"C:\Users\Admin\AppData\Local\Temp\0x000600000001ace7-182.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
  2⤵
  - Drops startup file
  - Views/modifies file attributes
  PID:4696
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
  2⤵
  - Views/modifies file attributes
  PID:3544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe

Filesize
26KB

MD5
921d7c2187427974a52b164873636bc3

SHA1
e8e3d80fa107c613a537bfabd6d6cd997d259928

SHA256
cc902803f8374f3f386b3537b86202b2f3c5557e9df541128a7b333c1db75f46

SHA512
ce1e6411f47f2961b150488b4c3f4dcfc9cf4e98a7a2e46a9855dd9e2ee33ba7e0e2644bde187635efb2d15d17bfb2da7e162cffa9fc7445da990d76f11f09a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe

Filesize
26KB

MD5
921d7c2187427974a52b164873636bc3

SHA1
e8e3d80fa107c613a537bfabd6d6cd997d259928

SHA256
cc902803f8374f3f386b3537b86202b2f3c5557e9df541128a7b333c1db75f46

SHA512
ce1e6411f47f2961b150488b4c3f4dcfc9cf4e98a7a2e46a9855dd9e2ee33ba7e0e2644bde187635efb2d15d17bfb2da7e162cffa9fc7445da990d76f11f09a9

Download Submit
memory/4884-132-0x0000000000940000-0x000000000094C000-memory.dmp

Filesize
48KB

Download
memory/4884-133-0x00000000052E0000-0x000000000537C000-memory.dmp

Filesize
624KB

Download
memory/4884-134-0x00000000061B0000-0x0000000006754000-memory.dmp

Filesize
5.6MB

Download
memory/4884-139-0x0000000005CA0000-0x0000000005D32000-memory.dmp

Filesize
584KB

Download
memory/4884-140-0x0000000005BE0000-0x0000000005BEA000-memory.dmp

Filesize
40KB

Download
memory/4884-141-0x0000000005E30000-0x0000000005E96000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads