njrat | bec45de531ea05bf558a58b477fa85b91f347cb203eb753579c3cebcedccbf31

General

Target

868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe
Size

180KB
MD5

4f333b5a74e464d8fd46fe49bedc760e
SHA1

110588bfa2559e700564af03db5cf851be5ac3d3
SHA256

868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d
SHA512

5ea9dbfae7dcf16f38aa0b064dd51cb7f6d398d5bb38b0877e9c7bf6b676151c01828c030d9d2f03707366651a66a3df39985aea43528baea55e79e83f784baf
SSDEEP

3072:AK3fycY2pTpIb42etB/RpH5pXZOaXqmmgDXnkUrsK0GEx4FvPA+LjpgKab8iPt9G:9r9GE7PH3XZ84kUuVxG7Hpg3f9dO+

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:5505

Mutex

Runtime Broker.exe

Attributes

reg_key
Runtime Broker.exe
splitter
|Ghost|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 3 IoCs

Processes:

Runtime Broker.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	Runtime Broker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe	Runtime Broker.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.url	Runtime Broker.exe

Executes dropped EXE 1 IoCs

Processes:

Runtime Broker.exe

pid process

1472 Runtime Broker.exe

pid	process
1472	Runtime Broker.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Runtime Broker.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker.exe = "\"C:\\ProgramData\\Runtime Broker.exe\" .."	Runtime Broker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker.exe = "\"C:\\ProgramData\\Runtime Broker.exe\" .."	Runtime Broker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Drops file in System32 directory 1 IoCs

Processes:

868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe

description ioc process

File created C:\windows\system32\vgga71.exe 868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 4 IoCs
evasion

Processes:

TASKKILL.exeTASKKILL.exeTASKKILL.exeTASKKILL.exe

pid process

1860 TASKKILL.exe
1396 TASKKILL.exe
316 TASKKILL.exe
900 TASKKILL.exe

description	ioc	process
File created	C:\windows\system32\vgga71.exe	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe

pid	process
1860	TASKKILL.exe
1396	TASKKILL.exe
316	TASKKILL.exe
900	TASKKILL.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exeRuntime Broker.exe

pid	process
1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe
1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe
1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe
1472	Runtime Broker.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exeTASKKILL.exeTASKKILL.exeRuntime Broker.exeTASKKILL.exeTASKKILL.exe

description	pid	process
Token: SeDebugPrivilege	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe
Token: SeDebugPrivilege	1860	TASKKILL.exe
Token: SeDebugPrivilege	1396	TASKKILL.exe
Token: SeDebugPrivilege	1472	Runtime Broker.exe
Token: SeDebugPrivilege	316	TASKKILL.exe
Token: SeDebugPrivilege	900	TASKKILL.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe
Token: 33	1472	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	1472	Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exeRuntime Broker.execmd.exe

description	pid	process	target process
PID 1852 wrote to memory of 1860	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	TASKKILL.exe
PID 1852 wrote to memory of 1860	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	TASKKILL.exe
PID 1852 wrote to memory of 1860	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	TASKKILL.exe
PID 1852 wrote to memory of 1396	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	TASKKILL.exe
PID 1852 wrote to memory of 1396	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	TASKKILL.exe
PID 1852 wrote to memory of 1396	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	TASKKILL.exe
PID 1852 wrote to memory of 1472	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	Runtime Broker.exe
PID 1852 wrote to memory of 1472	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	Runtime Broker.exe
PID 1852 wrote to memory of 1472	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	Runtime Broker.exe
PID 1852 wrote to memory of 1712	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	cmd.exe
PID 1852 wrote to memory of 1712	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	cmd.exe
PID 1852 wrote to memory of 1712	1852	868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe	cmd.exe
PID 1472 wrote to memory of 316	1472	Runtime Broker.exe	TASKKILL.exe
PID 1472 wrote to memory of 316	1472	Runtime Broker.exe	TASKKILL.exe
PID 1472 wrote to memory of 316	1472	Runtime Broker.exe	TASKKILL.exe
PID 1472 wrote to memory of 900	1472	Runtime Broker.exe	TASKKILL.exe
PID 1472 wrote to memory of 900	1472	Runtime Broker.exe	TASKKILL.exe
PID 1472 wrote to memory of 900	1472	Runtime Broker.exe	TASKKILL.exe
PID 1712 wrote to memory of 980	1712	cmd.exe	choice.exe
PID 1712 wrote to memory of 980	1712	cmd.exe	choice.exe
PID 1712 wrote to memory of 980	1712	cmd.exe	choice.exe
PID 1472 wrote to memory of 1672	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1672	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1672	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1524	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1524	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1524	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 796	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 796	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 796	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1592	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1592	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1592	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1584	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1584	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1584	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1796	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1796	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1796	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1300	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1300	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1300	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1860	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1860	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1860	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 2036	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 2036	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 2036	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1664	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1664	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1664	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1152	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1152	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1152	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1528	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1528	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1528	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1548	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1548	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1548	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 680	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 680	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 680	1472	Runtime Broker.exe	attrib.exe
PID 1472 wrote to memory of 1668	1472	Runtime Broker.exe	attrib.exe

Views/modifies file attributes 1 TTPs 20 IoCs

evasion

Hidden Files and Directories

T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
1672	attrib.exe
1152	attrib.exe
680	attrib.exe
1556	attrib.exe
1584	attrib.exe
1528	attrib.exe
1668	attrib.exe
1652	attrib.exe
888	attrib.exe
1796	attrib.exe
1300	attrib.exe
1860	attrib.exe
2036	attrib.exe
1524	attrib.exe
796	attrib.exe
1592	attrib.exe
1664	attrib.exe
1548	attrib.exe
1580	attrib.exe
1644	attrib.exe

C:\Users\Admin\AppData\Local\Temp\868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe
"C:\Users\Admin\AppData\Local\Temp\868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\system32\TASKKILL.exe
TASKKILL /F /IM wscript.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\system32\TASKKILL.exe
TASKKILL /F /IM cmd.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\ProgramData\Runtime Broker.exe
"C:\ProgramData\Runtime Broker.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\system32\TASKKILL.exe
TASKKILL /F /IM wscript.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:316

C:\Windows\system32\TASKKILL.exe
TASKKILL /F /IM cmd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1672

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1524

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:796

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1592

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1584

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1796

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1300

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1860

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:2036

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1664

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1152

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1528

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1548

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:680

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1668

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1580

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1652

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1556

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:1644

C:\Windows\system32\attrib.exe
attrib +h "C:\ProgramData\Runtime Broker.exe"
3⤵
- Views/modifies file attributes
PID:888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 5
3⤵
PID:980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Runtime Broker.exe
Filesize
180KB

MD5
4f333b5a74e464d8fd46fe49bedc760e

SHA1
110588bfa2559e700564af03db5cf851be5ac3d3

SHA256
868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d

SHA512
5ea9dbfae7dcf16f38aa0b064dd51cb7f6d398d5bb38b0877e9c7bf6b676151c01828c030d9d2f03707366651a66a3df39985aea43528baea55e79e83f784baf

Download Submit
C:\ProgramData\Runtime Broker.exe
Filesize
180KB

MD5
4f333b5a74e464d8fd46fe49bedc760e

SHA1
110588bfa2559e700564af03db5cf851be5ac3d3

SHA256
868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d

SHA512
5ea9dbfae7dcf16f38aa0b064dd51cb7f6d398d5bb38b0877e9c7bf6b676151c01828c030d9d2f03707366651a66a3df39985aea43528baea55e79e83f784baf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe
Filesize
180KB

MD5
4f333b5a74e464d8fd46fe49bedc760e

SHA1
110588bfa2559e700564af03db5cf851be5ac3d3

SHA256
868448f6c06d672fd544f64ae73ca4b1fe8403af947b870edd99ff842c02c59d

SHA512
5ea9dbfae7dcf16f38aa0b064dd51cb7f6d398d5bb38b0877e9c7bf6b676151c01828c030d9d2f03707366651a66a3df39985aea43528baea55e79e83f784baf

Download Submit
memory/1472-62-0x0000000000E80000-0x0000000000EB4000-memory.dmp

Filesize
208KB

Download
memory/1472-63-0x0000000000990000-0x0000000000A10000-memory.dmp

Filesize
512KB

Download
memory/1472-67-0x0000000000990000-0x0000000000A10000-memory.dmp

Filesize
512KB

Download
memory/1472-68-0x0000000000990000-0x0000000000A10000-memory.dmp

Filesize
512KB

Download
memory/1472-69-0x0000000000990000-0x0000000000A10000-memory.dmp

Filesize
512KB

Download
memory/1472-70-0x0000000000990000-0x0000000000A10000-memory.dmp

Filesize
512KB

Download
memory/1852-54-0x0000000000FF0000-0x0000000001024000-memory.dmp

Filesize
208KB

Download
memory/1852-55-0x00000000003F0000-0x0000000000406000-memory.dmp

Filesize
88KB

Download
memory/1852-56-0x0000000000DE0000-0x0000000000E60000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads