njrat | 868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-06-2023 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe
Size

180KB
MD5

4f333b5a74e464d8fd46fe49bedc760e
SHA1

110588bfa2559e700564af03db5cf851be5ac3d3
SHA256

868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d
SHA512

5ea9dbfae7dcf16f38aa0b064dd51cb7f6d398d5bb38b0877e9c7bf6b676151c01828c030d9d2f03707366651a66a3df39985aea43528baea55e79e83f784baf
SSDEEP

3072:AK3fycY2pTpIb42etB/RpH5pXZOaXqmmgDXnkUrsK0GEx4FvPA+LjpgKab8iPt9G:9r9GE7PH3XZ84kUuVxG7Hpg3f9dO+

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

127.0.0.1:5505

Mutex

Runtime Broker.exe

Attributes

reg_key
Runtime Broker.exe
splitter
|Ghost|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 3 IoCs

Processes:

Runtime Broker.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	Runtime Broker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	Runtime Broker.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.url	Runtime Broker.exe

Executes dropped EXE 1 IoCs

Processes:

Runtime Broker.exe

pid process

896 Runtime Broker.exe

pid	process
896	Runtime Broker.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Runtime Broker.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker.exe = "\"C:\\ProgramData\\Runtime Broker.exe\" .."	Runtime Broker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker.exe = "\"C:\\ProgramData\\Runtime Broker.exe\" .."	Runtime Broker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Drops file in System32 directory 1 IoCs

Processes:

868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe

description ioc process

File created C:\windows\system32\bu1w1r.exe 868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 4 IoCs
evasion

Processes:

TASKKILL.exeTASKKILL.exeTASKKILL.exeTASKKILL.exe

pid process

1708 TASKKILL.exe
1192 TASKKILL.exe
1576 TASKKILL.exe
1540 TASKKILL.exe

description	ioc	process
File created	C:\windows\system32\bu1w1r.exe	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe

pid	process
1708	TASKKILL.exe
1192	TASKKILL.exe
1576	TASKKILL.exe
1540	TASKKILL.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exeRuntime Broker.exe

pid	process
928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe
928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe
928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe
896	Runtime Broker.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exeTASKKILL.exeTASKKILL.exeRuntime Broker.exeTASKKILL.exeTASKKILL.exe

description	pid	process
Token: SeDebugPrivilege	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe
Token: SeDebugPrivilege	1708	TASKKILL.exe
Token: SeDebugPrivilege	1192	TASKKILL.exe
Token: SeDebugPrivilege	896	Runtime Broker.exe
Token: SeDebugPrivilege	1540	TASKKILL.exe
Token: SeDebugPrivilege	1576	TASKKILL.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe
Token: 33	896	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	896	Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exeRuntime Broker.execmd.exe

description	pid	process	target process
PID 928 wrote to memory of 1708	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	TASKKILL.exe
PID 928 wrote to memory of 1708	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	TASKKILL.exe
PID 928 wrote to memory of 1708	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	TASKKILL.exe
PID 928 wrote to memory of 1192	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	TASKKILL.exe
PID 928 wrote to memory of 1192	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	TASKKILL.exe
PID 928 wrote to memory of 1192	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	TASKKILL.exe
PID 928 wrote to memory of 896	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	Runtime Broker.exe
PID 928 wrote to memory of 896	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	Runtime Broker.exe
PID 928 wrote to memory of 896	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	Runtime Broker.exe
PID 928 wrote to memory of 1080	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	cmd.exe
PID 928 wrote to memory of 1080	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	cmd.exe
PID 928 wrote to memory of 1080	928	868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe	cmd.exe
PID 896 wrote to memory of 1540	896	Runtime Broker.exe	TASKKILL.exe
PID 896 wrote to memory of 1540	896	Runtime Broker.exe	TASKKILL.exe
PID 896 wrote to memory of 1540	896	Runtime Broker.exe	TASKKILL.exe
PID 896 wrote to memory of 1576	896	Runtime Broker.exe	TASKKILL.exe
PID 896 wrote to memory of 1576	896	Runtime Broker.exe	TASKKILL.exe
PID 896 wrote to memory of 1576	896	Runtime Broker.exe	TASKKILL.exe
PID 1080 wrote to memory of 2000	1080	cmd.exe	choice.exe
PID 1080 wrote to memory of 2000	1080	cmd.exe	choice.exe
PID 1080 wrote to memory of 2000	1080	cmd.exe	choice.exe
PID 896 wrote to memory of 1872	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1872	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1872	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1108	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1108	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1108	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 2032	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 2032	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 2032	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1220	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1220	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1220	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1588	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1588	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1588	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1620	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1620	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1620	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1416	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1416	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1416	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 268	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 268	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 268	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1660	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1660	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1660	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1420	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1420	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1420	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1268	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1268	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1268	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 840	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 840	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 840	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 476	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 476	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 476	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 296	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 296	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 296	896	Runtime Broker.exe	attrib.exe
PID 896 wrote to memory of 1040	896	Runtime Broker.exe	attrib.exe

Views/modifies file attributes 1 TTPs 21 IoCs

evasion

Hidden Files and Directories

T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
1220	attrib.exe
1620	attrib.exe
268	attrib.exe
840	attrib.exe
296	attrib.exe
2000	attrib.exe
1900	attrib.exe
1108	attrib.exe
1660	attrib.exe
1420	attrib.exe
1040	attrib.exe
1228	attrib.exe
1440	attrib.exe
1428	attrib.exe
2032	attrib.exe
1416	attrib.exe
1212	attrib.exe
1872	attrib.exe
1588	attrib.exe
1268	attrib.exe
476	attrib.exe

C:\Users\Admin\AppData\Local\Temp\868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe
"C:\Users\Admin\AppData\Local\Temp\868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\system32\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\system32\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\ProgramData\Runtime Broker.exe
  "C:\ProgramData\Runtime Broker.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\system32\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- - C:\Windows\system32\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1872
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1108
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:2032
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1220
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1588
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1620
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1416
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:268
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1660
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1420
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1268
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:840
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:476
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:296
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1040
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1228
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:2000
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1212
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1440
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1900
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\ProgramData\Runtime Broker.exe"
    3⤵
    - Views/modifies file attributes
    PID:1428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\868448F6C06D672FD544F64AE73CA4B1FE8403AF947B8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Runtime Broker.exe

Filesize
180KB

MD5
4f333b5a74e464d8fd46fe49bedc760e

SHA1
110588bfa2559e700564af03db5cf851be5ac3d3

SHA256
868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d

SHA512
5ea9dbfae7dcf16f38aa0b064dd51cb7f6d398d5bb38b0877e9c7bf6b676151c01828c030d9d2f03707366651a66a3df39985aea43528baea55e79e83f784baf

Download Submit
C:\ProgramData\Runtime Broker.exe

Filesize
180KB

MD5
4f333b5a74e464d8fd46fe49bedc760e

SHA1
110588bfa2559e700564af03db5cf851be5ac3d3

SHA256
868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d

SHA512
5ea9dbfae7dcf16f38aa0b064dd51cb7f6d398d5bb38b0877e9c7bf6b676151c01828c030d9d2f03707366651a66a3df39985aea43528baea55e79e83f784baf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe

Filesize
180KB

MD5
4f333b5a74e464d8fd46fe49bedc760e

SHA1
110588bfa2559e700564af03db5cf851be5ac3d3

SHA256
868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d

SHA512
5ea9dbfae7dcf16f38aa0b064dd51cb7f6d398d5bb38b0877e9c7bf6b676151c01828c030d9d2f03707366651a66a3df39985aea43528baea55e79e83f784baf

Download Submit
memory/896-62-0x00000000002B0000-0x00000000002E4000-memory.dmp

Filesize
208KB

Download
memory/896-63-0x000000001ACE0000-0x000000001AD60000-memory.dmp

Filesize
512KB

Download
memory/896-67-0x000000001ACE0000-0x000000001AD60000-memory.dmp

Filesize
512KB

Download
memory/928-54-0x0000000000E60000-0x0000000000E94000-memory.dmp

Filesize
208KB

Download
memory/928-55-0x0000000000280000-0x0000000000296000-memory.dmp

Filesize
88KB

Download
memory/928-56-0x000000001AE00000-0x000000001AE80000-memory.dmp

Filesize
512KB

Download