njrat | 3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfcee11e3100662568f6dc68a1058a7e.exe
Size

93KB
MD5

cfcee11e3100662568f6dc68a1058a7e
SHA1

c8662a4be2b73a1e45f54a55bf0c627b9f4965c7
SHA256

3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc
SHA512

daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe
SSDEEP

1536:Hm0YeVBvb5Lncb1AG8jEwzGi1dD+DQgS:Hm8Bvb57cBbdi1dY5

Score

10^/10

njrat lox evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

LOX

NC50Y3AuZXUubmdyb2suaW8Strik:MTc1Mzg=

Mutex

84211ece177abd5f84de6311a704f29d

Attributes

reg_key
84211ece177abd5f84de6311a704f29d
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1252	netsh.exe
1560	netsh.exe
520	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe

Executes dropped EXE 1 IoCs

pid	Process
1804	server.exe

Loads dropped DLL 2 IoCs

pid	Process
1344	cfcee11e3100662568f6dc68a1058a7e.exe
1344	cfcee11e3100662568f6dc68a1058a7e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	server.exe
File opened for modification	C:\autorun.inf	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe
1804	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1804	server.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe
Token: 33	1804	server.exe
Token: SeIncBasePriorityPrivilege	1804	server.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1804	1344	cfcee11e3100662568f6dc68a1058a7e.exe	28
PID 1344 wrote to memory of 1804	1344	cfcee11e3100662568f6dc68a1058a7e.exe	28
PID 1344 wrote to memory of 1804	1344	cfcee11e3100662568f6dc68a1058a7e.exe	28
PID 1344 wrote to memory of 1804	1344	cfcee11e3100662568f6dc68a1058a7e.exe	28
PID 1804 wrote to memory of 520	1804	server.exe	29
PID 1804 wrote to memory of 520	1804	server.exe	29
PID 1804 wrote to memory of 520	1804	server.exe	29
PID 1804 wrote to memory of 520	1804	server.exe	29
PID 1804 wrote to memory of 1252	1804	server.exe	31
PID 1804 wrote to memory of 1252	1804	server.exe	31
PID 1804 wrote to memory of 1252	1804	server.exe	31
PID 1804 wrote to memory of 1252	1804	server.exe	31
PID 1804 wrote to memory of 1560	1804	server.exe	32
PID 1804 wrote to memory of 1560	1804	server.exe	32
PID 1804 wrote to memory of 1560	1804	server.exe	32
PID 1804 wrote to memory of 1560	1804	server.exe	32

C:\Users\Admin\AppData\Local\Temp\cfcee11e3100662568f6dc68a1058a7e.exe
"C:\Users\Admin\AppData\Local\Temp\cfcee11e3100662568f6dc68a1058a7e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Roaming\server.exe
  "C:\Users\Admin\AppData\Roaming\server.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops autorun.inf file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:520
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
    3⤵
    - Modifies Windows Firewall
    PID:1252
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
c2844bc9e1bd64168a727b0680ae4d90

SHA1
7bb263540de557f5a4e09c6c78b7dbb314a0df9a

SHA256
9c9701ab918368b615fc6a0dbeb5efa286a232d751982ae70b48ad6914bf01e5

SHA512
360953bb20d91539022fcb1becf4638970c4452816797a8dca65e3ae4a542302e6e89f0828087caaa63a0750aa78605f8034da7c8663fa4fc677c8f3e53655ed

Download Submit
C:\Users\Admin\AppData\Roaming\server.exe

Filesize
93KB

MD5
cfcee11e3100662568f6dc68a1058a7e

SHA1
c8662a4be2b73a1e45f54a55bf0c627b9f4965c7

SHA256
3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

SHA512
daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe

Download Submit
C:\Users\Admin\AppData\Roaming\server.exe

Filesize
93KB

MD5
cfcee11e3100662568f6dc68a1058a7e

SHA1
c8662a4be2b73a1e45f54a55bf0c627b9f4965c7

SHA256
3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

SHA512
daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe

Download Submit
C:\Users\Admin\AppData\Roaming\server.exe

Filesize
93KB

MD5
cfcee11e3100662568f6dc68a1058a7e

SHA1
c8662a4be2b73a1e45f54a55bf0c627b9f4965c7

SHA256
3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

SHA512
daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe

Download Submit
\Users\Admin\AppData\Roaming\server.exe

Filesize
93KB

MD5
cfcee11e3100662568f6dc68a1058a7e

SHA1
c8662a4be2b73a1e45f54a55bf0c627b9f4965c7

SHA256
3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

SHA512
daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe

Download Submit
\Users\Admin\AppData\Roaming\server.exe

Filesize
93KB

MD5
cfcee11e3100662568f6dc68a1058a7e

SHA1
c8662a4be2b73a1e45f54a55bf0c627b9f4965c7

SHA256
3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

SHA512
daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe

Download Submit
memory/1344-55-0x0000000000240000-0x0000000000280000-memory.dmp

Filesize
256KB

Download
memory/1804-66-0x0000000001DE0000-0x0000000001E20000-memory.dmp

Filesize
256KB

Download
memory/1804-74-0x0000000001DE0000-0x0000000001E20000-memory.dmp

Filesize
256KB

Download