njrat | 3278da5825f2fa9fe2fae3a9cb16d3d8e3c47828c2258153e02567c7bc423fec

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

360feb26856fd5accc8e656c23edaf38.exe
Size

43KB
MD5

360feb26856fd5accc8e656c23edaf38
SHA1

1dcc19bc5f4c2bc259b40c2ba2a92e8fb35ac288
SHA256

3278da5825f2fa9fe2fae3a9cb16d3d8e3c47828c2258153e02567c7bc423fec
SHA512

75449ad3efdbad7046d2bd29c89aed435498498957e5b14f21ca928100a023acab0514c5c206c86ba9830f60e96d0222310879d23e974d057cbdfdab54b0ba9d
SSDEEP

384:68ZyiQt3VarE8yTH/fq5WKOEnsDay0+TzEIij+ZsNO3PlpJKkkjh/TzF7pWnB/gm:66t63MY5Tffq5hGDFuXQ/oQ3+L

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

5.tcp.eu.ngrok.io:19987

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

Dllhost.exe

pid process

836 Dllhost.exe
Loads dropped DLL 1 IoCs

Processes:

360feb26856fd5accc8e656c23edaf38.exe

pid process

920 360feb26856fd5accc8e656c23edaf38.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Dllhost.exe

pid process

836 Dllhost.exe

pid	process
836	Dllhost.exe

pid	process
920	360feb26856fd5accc8e656c23edaf38.exe

pid	process
836	Dllhost.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

Dllhost.exe

description	pid	process
Token: SeDebugPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe
Token: 33	836	Dllhost.exe
Token: SeIncBasePriorityPrivilege	836	Dllhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

360feb26856fd5accc8e656c23edaf38.exe

description	pid	process	target process
PID 920 wrote to memory of 836	920	360feb26856fd5accc8e656c23edaf38.exe	Dllhost.exe
PID 920 wrote to memory of 836	920	360feb26856fd5accc8e656c23edaf38.exe	Dllhost.exe
PID 920 wrote to memory of 836	920	360feb26856fd5accc8e656c23edaf38.exe	Dllhost.exe
PID 920 wrote to memory of 836	920	360feb26856fd5accc8e656c23edaf38.exe	Dllhost.exe

C:\Users\Admin\AppData\Local\Temp\360feb26856fd5accc8e656c23edaf38.exe
"C:\Users\Admin\AppData\Local\Temp\360feb26856fd5accc8e656c23edaf38.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:920

C:\Users\Admin\AppData\Roaming\Dllhost.exe
"C:\Users\Admin\AppData\Roaming\Dllhost.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Dllhost.exe
Filesize
43KB

MD5
360feb26856fd5accc8e656c23edaf38

SHA1
1dcc19bc5f4c2bc259b40c2ba2a92e8fb35ac288

SHA256
3278da5825f2fa9fe2fae3a9cb16d3d8e3c47828c2258153e02567c7bc423fec

SHA512
75449ad3efdbad7046d2bd29c89aed435498498957e5b14f21ca928100a023acab0514c5c206c86ba9830f60e96d0222310879d23e974d057cbdfdab54b0ba9d

Download Submit
C:\Users\Admin\AppData\Roaming\Dllhost.exe
Filesize
43KB

MD5
360feb26856fd5accc8e656c23edaf38

SHA1
1dcc19bc5f4c2bc259b40c2ba2a92e8fb35ac288

SHA256
3278da5825f2fa9fe2fae3a9cb16d3d8e3c47828c2258153e02567c7bc423fec

SHA512
75449ad3efdbad7046d2bd29c89aed435498498957e5b14f21ca928100a023acab0514c5c206c86ba9830f60e96d0222310879d23e974d057cbdfdab54b0ba9d

Download Submit
\Users\Admin\AppData\Roaming\Dllhost.exe
Filesize
43KB

MD5
360feb26856fd5accc8e656c23edaf38

SHA1
1dcc19bc5f4c2bc259b40c2ba2a92e8fb35ac288

SHA256
3278da5825f2fa9fe2fae3a9cb16d3d8e3c47828c2258153e02567c7bc423fec

SHA512
75449ad3efdbad7046d2bd29c89aed435498498957e5b14f21ca928100a023acab0514c5c206c86ba9830f60e96d0222310879d23e974d057cbdfdab54b0ba9d

Download Submit
memory/836-63-0x0000000000E00000-0x0000000000E12000-memory.dmp

Filesize
72KB

Download
memory/836-64-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Filesize
256KB

Download
memory/836-65-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Filesize
256KB

Download
memory/920-54-0x0000000001310000-0x0000000001322000-memory.dmp

Filesize
72KB

Download
memory/920-55-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download