njrat | d0a7edca52c4438b8d762c95b938497b23b03a26d1bbca6030efe02278cba873

General

Target

Setup.exe
Size

23KB
MD5

530315190b0f070495170cdeed19a633
SHA1

747096c8177da1b0f54fc95ec10ceb33253512db
SHA256

d0a7edca52c4438b8d762c95b938497b23b03a26d1bbca6030efe02278cba873
SHA512

e250a01509e064b3a1c6d3fac9e59587800e8b0a1cce50689c6e2edab0565d876841d3f16cd06505d24d244d3135f8e1773ba892565f414ba24d81661eab3b7b
SSDEEP

384:T0jeCIYTNQZUuQnJXJeCXlwhPQ6VgDOwBHhdmRvR6JZlbw8hqIusZzZqs:w3jNAU/ZVX6RpcnuA

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4452 netsh.exe

pid	process
4452	netsh.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Setup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\80c658117c3e8fc69d003db56b7c569a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Setup.exe\" .."	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\80c658117c3e8fc69d003db56b7c569a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Setup.exe\" .."	Setup.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

Setup.exe

description	pid	process
Token: SeDebugPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe
Token: 33	4080	Setup.exe
Token: SeIncBasePriorityPrivilege	4080	Setup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

3700 LogonUI.exe

pid	process
3700	LogonUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 4080 wrote to memory of 4452	4080	Setup.exe	netsh.exe
PID 4080 wrote to memory of 4452	4080	Setup.exe	netsh.exe
PID 4080 wrote to memory of 4452	4080	Setup.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Setup.exe" "Setup.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:4452

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad4855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4080-120-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/4080-121-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/4080-122-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/4080-123-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads