njrat | 1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

General

Target

bacc4221cd4d6009fbabd8a7194bb07c.exe
Size

43KB
MD5

bacc4221cd4d6009fbabd8a7194bb07c
SHA1

feb85c565496e6e33ac90352816d35241aa689ca
SHA256

1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe
SHA512

943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50
SSDEEP

384:lZyuAFkV6Lk8y85LPjn1m0O6EES+0JKVHbzzIij+ZsNO3PlpJKkkjh/TzF7pWnC2:vHAFksY5ebjn1m0Z2JK2uXQ/ojt2+L

Score

10^/10

njrat hacker trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

Hacker

C2

5.tcp.eu.ngrok.io:15728

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

Processes:

WinRar.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	WinRar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	WinRar.exe

Executes dropped EXE 3 IoCs

Processes:

WinRar.exeServer.exeServer.exe

pid process

584 WinRar.exe
1680 Server.exe
1824 Server.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
584	WinRar.exe
1680	Server.exe
1824	Server.exe

Drops file in Windows directory 2 IoCs

Processes:

bacc4221cd4d6009fbabd8a7194bb07c.exeWinRar.exe

description	ioc	process
File created	C:\Windows\WinRar.exe	bacc4221cd4d6009fbabd8a7194bb07c.exe
File opened for modification	C:\Windows\WinRar.exe	WinRar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1496 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WinRar.exe

pid process

584 WinRar.exe

pid	process
1496	schtasks.exe

pid	process
584	WinRar.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

WinRar.exe

description	pid	process
Token: SeDebugPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe
Token: 33	584	WinRar.exe
Token: SeIncBasePriorityPrivilege	584	WinRar.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

bacc4221cd4d6009fbabd8a7194bb07c.exeWinRar.exetaskeng.exe

description	pid	process	target process
PID 824 wrote to memory of 584	824	bacc4221cd4d6009fbabd8a7194bb07c.exe	WinRar.exe
PID 824 wrote to memory of 584	824	bacc4221cd4d6009fbabd8a7194bb07c.exe	WinRar.exe
PID 824 wrote to memory of 584	824	bacc4221cd4d6009fbabd8a7194bb07c.exe	WinRar.exe
PID 824 wrote to memory of 584	824	bacc4221cd4d6009fbabd8a7194bb07c.exe	WinRar.exe
PID 584 wrote to memory of 1496	584	WinRar.exe	schtasks.exe
PID 584 wrote to memory of 1496	584	WinRar.exe	schtasks.exe
PID 584 wrote to memory of 1496	584	WinRar.exe	schtasks.exe
PID 584 wrote to memory of 1496	584	WinRar.exe	schtasks.exe
PID 536 wrote to memory of 1680	536	taskeng.exe	Server.exe
PID 536 wrote to memory of 1680	536	taskeng.exe	Server.exe
PID 536 wrote to memory of 1680	536	taskeng.exe	Server.exe
PID 536 wrote to memory of 1680	536	taskeng.exe	Server.exe
PID 536 wrote to memory of 1824	536	taskeng.exe	Server.exe
PID 536 wrote to memory of 1824	536	taskeng.exe	Server.exe
PID 536 wrote to memory of 1824	536	taskeng.exe	Server.exe
PID 536 wrote to memory of 1824	536	taskeng.exe	Server.exe

C:\Users\Admin\AppData\Local\Temp\bacc4221cd4d6009fbabd8a7194bb07c.exe
"C:\Users\Admin\AppData\Local\Temp\bacc4221cd4d6009fbabd8a7194bb07c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\WinRar.exe
"C:\Windows\WinRar.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
3⤵
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\taskeng.exe
taskeng.exe {F397E83D-DED8-4890-9E55-C969C3950D00} S-1-5-21-2961826002-3968192592-354541192-1000:HVMHZIYD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:1680

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:1824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Windows\WinRar.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Windows\WinRar.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
memory/584-62-0x00000000011A0000-0x00000000011B2000-memory.dmp

Filesize
72KB

Download
memory/824-54-0x00000000000D0000-0x00000000000E2000-memory.dmp

Filesize
72KB

Download
memory/824-55-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1680-67-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1824-69-0x0000000000BE0000-0x0000000000BF2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads