njrat | 20323c926f442b8e630948e1cf05151e95ced1d35792d0a86feba22296947326

General

Target

9fbfec21731138df6ca9a8f18d02262b.exe
Size

43KB
MD5

9fbfec21731138df6ca9a8f18d02262b
SHA1

bea9f533b6178d0be6ba7b4e1cc26ee05aff9cd7
SHA256

20323c926f442b8e630948e1cf05151e95ced1d35792d0a86feba22296947326
SHA512

ca49d9eae5f0a009f44bec10b11abc4f76d18b6394e91114be895caaedbc6dc4ad4a6ea8b0063b7c1613323dda479a722a93340426ef2c77722cce7f44014707
SSDEEP

384:tZyyV9xdW/IUyNZcP54Fi1OOOETDF56lhzYIij+ZsNO3PlpJKkkjh/TzF7pWnACl:HTDxIghNZ854Fi1lxDShuXQ/oZW+L

Score

10^/10

njrat ???persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

???

C2

0.tcp.eu.ngrok.io:18362

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

Processes:

9fbfec21731138df6ca9a8f18d02262b.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	9fbfec21731138df6ca9a8f18d02262b.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	9fbfec21731138df6ca9a8f18d02262b.exe

Executes dropped EXE 2 IoCs

Processes:

Server.exeServer.exe

pid process

1644 Server.exe
1536 Server.exe

pid	process
1644	Server.exe
1536	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9fbfec21731138df6ca9a8f18d02262b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9fbfec21731138df6ca9a8f18d02262b.exe\" .."	9fbfec21731138df6ca9a8f18d02262b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9fbfec21731138df6ca9a8f18d02262b.exe\" .."	9fbfec21731138df6ca9a8f18d02262b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1216 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

9fbfec21731138df6ca9a8f18d02262b.exe

pid process

1740 9fbfec21731138df6ca9a8f18d02262b.exe

pid	process
1216	schtasks.exe

pid	process
1740	9fbfec21731138df6ca9a8f18d02262b.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

9fbfec21731138df6ca9a8f18d02262b.exe

description	pid	process
Token: SeDebugPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: 33	1740	9fbfec21731138df6ca9a8f18d02262b.exe
Token: SeIncBasePriorityPrivilege	1740	9fbfec21731138df6ca9a8f18d02262b.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9fbfec21731138df6ca9a8f18d02262b.exetaskeng.exe

description	pid	process	target process
PID 1740 wrote to memory of 1216	1740	9fbfec21731138df6ca9a8f18d02262b.exe	schtasks.exe
PID 1740 wrote to memory of 1216	1740	9fbfec21731138df6ca9a8f18d02262b.exe	schtasks.exe
PID 1740 wrote to memory of 1216	1740	9fbfec21731138df6ca9a8f18d02262b.exe	schtasks.exe
PID 1740 wrote to memory of 1216	1740	9fbfec21731138df6ca9a8f18d02262b.exe	schtasks.exe
PID 996 wrote to memory of 1644	996	taskeng.exe	Server.exe
PID 996 wrote to memory of 1644	996	taskeng.exe	Server.exe
PID 996 wrote to memory of 1644	996	taskeng.exe	Server.exe
PID 996 wrote to memory of 1644	996	taskeng.exe	Server.exe
PID 996 wrote to memory of 1536	996	taskeng.exe	Server.exe
PID 996 wrote to memory of 1536	996	taskeng.exe	Server.exe
PID 996 wrote to memory of 1536	996	taskeng.exe	Server.exe
PID 996 wrote to memory of 1536	996	taskeng.exe	Server.exe

C:\Users\Admin\AppData\Local\Temp\9fbfec21731138df6ca9a8f18d02262b.exe
"C:\Users\Admin\AppData\Local\Temp\9fbfec21731138df6ca9a8f18d02262b.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Creates scheduled task(s)
PID:1216

C:\Windows\system32\taskeng.exe
taskeng.exe {93BFA74B-037E-4C26-B47D-A07C72581BDE} S-1-5-21-3499517378-2376672570-1134980332-1000:MLXLFKOI\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:1644

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:1536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
9fbfec21731138df6ca9a8f18d02262b

SHA1
bea9f533b6178d0be6ba7b4e1cc26ee05aff9cd7

SHA256
20323c926f442b8e630948e1cf05151e95ced1d35792d0a86feba22296947326

SHA512
ca49d9eae5f0a009f44bec10b11abc4f76d18b6394e91114be895caaedbc6dc4ad4a6ea8b0063b7c1613323dda479a722a93340426ef2c77722cce7f44014707

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
9fbfec21731138df6ca9a8f18d02262b

SHA1
bea9f533b6178d0be6ba7b4e1cc26ee05aff9cd7

SHA256
20323c926f442b8e630948e1cf05151e95ced1d35792d0a86feba22296947326

SHA512
ca49d9eae5f0a009f44bec10b11abc4f76d18b6394e91114be895caaedbc6dc4ad4a6ea8b0063b7c1613323dda479a722a93340426ef2c77722cce7f44014707

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
9fbfec21731138df6ca9a8f18d02262b

SHA1
bea9f533b6178d0be6ba7b4e1cc26ee05aff9cd7

SHA256
20323c926f442b8e630948e1cf05151e95ced1d35792d0a86feba22296947326

SHA512
ca49d9eae5f0a009f44bec10b11abc4f76d18b6394e91114be895caaedbc6dc4ad4a6ea8b0063b7c1613323dda479a722a93340426ef2c77722cce7f44014707

Download Submit
memory/1536-63-0x0000000000A00000-0x0000000000A12000-memory.dmp

Filesize
72KB

Download
memory/1536-64-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/1644-60-0x00000000009F0000-0x0000000000A02000-memory.dmp

Filesize
72KB

Download
memory/1644-61-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download
memory/1740-54-0x0000000000B70000-0x0000000000B82000-memory.dmp

Filesize
72KB

Download
memory/1740-55-0x00000000047C0000-0x0000000004800000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads