njrat | ea7b6a646acf868d2a664faee0b2ef448b5b5ef56dab2f2aaf38e24583814347

General

Target

b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe
Size

22KB
MD5

00f1f5306a56f3f7b974b492624252c9
SHA1

dc42afbc3ae037bfb948e7ba2a3fa1857eb9f4f0
SHA256

b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e
SHA512

c059be9a1ed34d3072e307825e0300f2d718cdadee893d667a506dd448e15832db4495002fdeef13d08b1d4a20e90951941b73733974a59b932aec4d20e4442c
SSDEEP

384:jc6CqbFYh3odrVCGiHssOB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZdvf:YIU0twQRpcnuw3

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

kassar963-63714.portmap.host:60000

Mutex

69e2e2bb4c3b8058a86847f0287d8ca1

Attributes

reg_key
69e2e2bb4c3b8058a86847f0287d8ca1
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1368 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

2028 server.exe

pid	process
1368	netsh.exe

pid	process
2028	server.exe

Loads dropped DLL 2 IoCs

Processes:

b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe

pid	process
1372	b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe
1372	b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\69e2e2bb4c3b8058a86847f0287d8ca1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\69e2e2bb4c3b8058a86847f0287d8ca1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe
Token: 33	2028	server.exe
Token: SeIncBasePriorityPrivilege	2028	server.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exeserver.exe

description	pid	process	target process
PID 1372 wrote to memory of 2028	1372	b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe	server.exe
PID 1372 wrote to memory of 2028	1372	b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe	server.exe
PID 1372 wrote to memory of 2028	1372	b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe	server.exe
PID 1372 wrote to memory of 2028	1372	b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe	server.exe
PID 2028 wrote to memory of 1368	2028	server.exe	netsh.exe
PID 2028 wrote to memory of 1368	2028	server.exe	netsh.exe
PID 2028 wrote to memory of 1368	2028	server.exe	netsh.exe
PID 2028 wrote to memory of 1368	2028	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe
"C:\Users\Admin\AppData\Local\Temp\b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1372

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
22KB

MD5
00f1f5306a56f3f7b974b492624252c9

SHA1
dc42afbc3ae037bfb948e7ba2a3fa1857eb9f4f0

SHA256
b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e

SHA512
c059be9a1ed34d3072e307825e0300f2d718cdadee893d667a506dd448e15832db4495002fdeef13d08b1d4a20e90951941b73733974a59b932aec4d20e4442c

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
22KB

MD5
00f1f5306a56f3f7b974b492624252c9

SHA1
dc42afbc3ae037bfb948e7ba2a3fa1857eb9f4f0

SHA256
b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e

SHA512
c059be9a1ed34d3072e307825e0300f2d718cdadee893d667a506dd448e15832db4495002fdeef13d08b1d4a20e90951941b73733974a59b932aec4d20e4442c

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
22KB

MD5
00f1f5306a56f3f7b974b492624252c9

SHA1
dc42afbc3ae037bfb948e7ba2a3fa1857eb9f4f0

SHA256
b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e

SHA512
c059be9a1ed34d3072e307825e0300f2d718cdadee893d667a506dd448e15832db4495002fdeef13d08b1d4a20e90951941b73733974a59b932aec4d20e4442c

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
22KB

MD5
00f1f5306a56f3f7b974b492624252c9

SHA1
dc42afbc3ae037bfb948e7ba2a3fa1857eb9f4f0

SHA256
b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e

SHA512
c059be9a1ed34d3072e307825e0300f2d718cdadee893d667a506dd448e15832db4495002fdeef13d08b1d4a20e90951941b73733974a59b932aec4d20e4442c

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe
Filesize
22KB

MD5
00f1f5306a56f3f7b974b492624252c9

SHA1
dc42afbc3ae037bfb948e7ba2a3fa1857eb9f4f0

SHA256
b6eb6e88c8aad20fad304972eef236e283ba139c339b662c877d18606427be8e

SHA512
c059be9a1ed34d3072e307825e0300f2d718cdadee893d667a506dd448e15832db4495002fdeef13d08b1d4a20e90951941b73733974a59b932aec4d20e4442c

Download Submit
memory/1372-54-0x0000000000B80000-0x0000000000BC0000-memory.dmp

Filesize
256KB

Download
memory/2028-65-0x0000000000830000-0x0000000000870000-memory.dmp

Filesize
256KB

Download
memory/2028-66-0x0000000000830000-0x0000000000870000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads