njrat | 1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

General

Target

bacc4221cd4d6009fbabd8a7194bb07c.exe
Size

43KB
MD5

bacc4221cd4d6009fbabd8a7194bb07c
SHA1

feb85c565496e6e33ac90352816d35241aa689ca
SHA256

1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe
SHA512

943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50
SSDEEP

384:lZyuAFkV6Lk8y85LPjn1m0O6EES+0JKVHbzzIij+ZsNO3PlpJKkkjh/TzF7pWnC2:vHAFksY5ebjn1m0Z2JK2uXQ/ojt2+L

Score

10^/10

njrat hacker trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

Hacker

C2

5.tcp.eu.ngrok.io:15728

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bacc4221cd4d6009fbabd8a7194bb07c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	bacc4221cd4d6009fbabd8a7194bb07c.exe

Drops startup file 2 IoCs

Processes:

WinRar.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	WinRar.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	WinRar.exe

Executes dropped EXE 3 IoCs

Processes:

WinRar.exeServer.exeServer.exe

pid process

4472 WinRar.exe
1772 Server.exe
4428 Server.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
4472	WinRar.exe
1772	Server.exe
4428	Server.exe

Drops file in Windows directory 2 IoCs

Processes:

bacc4221cd4d6009fbabd8a7194bb07c.exeWinRar.exe

description	ioc	process
File created	C:\Windows\WinRar.exe	bacc4221cd4d6009fbabd8a7194bb07c.exe
File opened for modification	C:\Windows\WinRar.exe	WinRar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4804 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

bacc4221cd4d6009fbabd8a7194bb07c.exeWinRar.exe

pid process

648 bacc4221cd4d6009fbabd8a7194bb07c.exe
4472 WinRar.exe

pid	process
4804	schtasks.exe

pid	process
648	bacc4221cd4d6009fbabd8a7194bb07c.exe
4472	WinRar.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

WinRar.exe

description	pid	process
Token: SeDebugPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe
Token: 33	4472	WinRar.exe
Token: SeIncBasePriorityPrivilege	4472	WinRar.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

bacc4221cd4d6009fbabd8a7194bb07c.exeWinRar.exe

description	pid	process	target process
PID 648 wrote to memory of 4472	648	bacc4221cd4d6009fbabd8a7194bb07c.exe	WinRar.exe
PID 648 wrote to memory of 4472	648	bacc4221cd4d6009fbabd8a7194bb07c.exe	WinRar.exe
PID 648 wrote to memory of 4472	648	bacc4221cd4d6009fbabd8a7194bb07c.exe	WinRar.exe
PID 4472 wrote to memory of 4804	4472	WinRar.exe	schtasks.exe
PID 4472 wrote to memory of 4804	4472	WinRar.exe	schtasks.exe
PID 4472 wrote to memory of 4804	4472	WinRar.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\bacc4221cd4d6009fbabd8a7194bb07c.exe
"C:\Users\Admin\AppData\Local\Temp\bacc4221cd4d6009fbabd8a7194bb07c.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\WinRar.exe
"C:\Windows\WinRar.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
3⤵
- Creates scheduled task(s)
PID:4804

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:4428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.log
Filesize
507B

MD5
25d1b50e7c0d451f3d850eb54d27ca05

SHA1
a238807715c70a335f54e80d4855644b21a9e870

SHA256
650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5

SHA512
4223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Windows\WinRar.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Windows\WinRar.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
C:\Windows\WinRar.exe
Filesize
43KB

MD5
bacc4221cd4d6009fbabd8a7194bb07c

SHA1
feb85c565496e6e33ac90352816d35241aa689ca

SHA256
1e39fa1f931865fbce1da5c91b4223683333335426733ad41c1bf050a82b44fe

SHA512
943c191fa03ec068d7d5534b51462946141706ae1f23ea9d7a5f0971f00c208c6a481822fb76d7b4af7cea2ef06964aa4c62bbf5d90e74a6ca14ff9fef361a50

Download Submit
memory/648-137-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/648-133-0x0000000000780000-0x0000000000792000-memory.dmp

Filesize
72KB

Download
memory/648-136-0x0000000005530000-0x00000000055C2000-memory.dmp

Filesize
584KB

Download
memory/648-135-0x0000000005A30000-0x0000000005FD4000-memory.dmp

Filesize
5.6MB

Download
memory/648-134-0x0000000005130000-0x00000000051CC000-memory.dmp

Filesize
624KB

Download
memory/1772-155-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4428-159-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4472-147-0x0000000005A50000-0x0000000005A60000-memory.dmp

Filesize
64KB

Download
memory/4472-150-0x0000000005A50000-0x0000000005A60000-memory.dmp

Filesize
64KB

Download
memory/4472-151-0x0000000005B30000-0x0000000005B3A000-memory.dmp

Filesize
40KB

Download
memory/4472-152-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads