Overview

overview

10

Static

static

10

nagogy-Client.exe

windows10-1703-x64

10

nagogy-Client.exe

windows7-x64

1

nagogy-Client.exe

windows10-2004-x64

10

nagogy-Client.exe

android-10-x64

nagogy-Client.exe

android-11-x64

nagogy-Client.exe

android-9-x86

nagogy-Client.exe

macos-10.15-amd64

1

nagogy-Client.exe

debian-9-armhf

nagogy-Client.exe

debian-9-mips

nagogy-Client.exe

debian-9-mipsel

nagogy-Client.exe

ubuntu-18.04-amd64

Analysis

  • max time kernel
    78s
  • max time network
    83s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2023, 17:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    nagogy-Client.exe

  • Size

    159KB

  • MD5

    ecca6b799f217842229d175a695d2993

  • SHA1

    232d3b92b25224f6b97e961a10fc0175163f4cc4

  • SHA256

    93e90ecd12401fad5032a113663d81cab58aa137c4baafb1628ef71c4c27ffb1

  • SHA512

    6367675cb3f86b06c23854bfb829f92cb084caf34592038236d33110267938f9e97982f290dea819febcc66bb08e334ac4f170bd6664ea9b4fa49bd1f998cb46

  • SSDEEP

    3072:T3sO174KPnPE73cMSfGGcADh0nVqLH4XOtpWH3mkl0mOlylll+ilkHmllillll+y:QxbSfGGjdY+t3scbsubRZ

Score
10/10
njratpersistencetrojan

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 6 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nagogy-Client.exe
    "C:\Users\Admin\AppData\Local\Temp\nagogy-Client.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /tn NYANP /F
      2⤵
        PID:4384
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\nagogy-Client.exe" /sc minute /mo 5
        2⤵
        • Creates scheduled task(s)
        PID:5060
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /F /IM wscript.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:368
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /F /IM cmd.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3356
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Delete /tn NYAN /F
        2⤵
          PID:4876
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\nagogy-Client.exe" /sc minute /mo 1
          2⤵
          • Creates scheduled task(s)
          PID:3208
        • C:\Users\Admin\AppData\Local\Temp\Client.exe
          "C:\Users\Admin\AppData\Local\Temp\Client.exe"
          2⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3252
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Delete /tn NYANP /F
            3⤵
              PID:700
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 5
              3⤵
              • Creates scheduled task(s)
              PID:3420
            • C:\Windows\SysWOW64\TASKKILL.exe
              TASKKILL /F /IM cmd.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1476
            • C:\Windows\SysWOW64\TASKKILL.exe
              TASKKILL /F /IM wscript.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2520
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Delete /tn NYAN /F
              3⤵
                PID:1852
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 1
                3⤵
                • Creates scheduled task(s)
                PID:4852
          • C:\Users\Admin\AppData\Local\Temp\Client.exe
            C:\Users\Admin\AppData\Local\Temp\Client.exe
            1⤵
            • Drops startup file
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4380
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Delete /tn NYANP /F
              2⤵
                PID:2084
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 5
                2⤵
                • Creates scheduled task(s)
                PID:764
              • C:\Windows\SysWOW64\TASKKILL.exe
                TASKKILL /F /IM wscript.exe
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4616
              • C:\Windows\SysWOW64\TASKKILL.exe
                TASKKILL /F /IM cmd.exe
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4188
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Delete /tn NYAN /F
                2⤵
                  PID:3864
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 1
                  2⤵
                  • Creates scheduled task(s)
                  PID:3920

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\Client.exe
                Filesize

                159KB

                MD5

                ecca6b799f217842229d175a695d2993

                SHA1

                232d3b92b25224f6b97e961a10fc0175163f4cc4

                SHA256

                93e90ecd12401fad5032a113663d81cab58aa137c4baafb1628ef71c4c27ffb1

                SHA512

                6367675cb3f86b06c23854bfb829f92cb084caf34592038236d33110267938f9e97982f290dea819febcc66bb08e334ac4f170bd6664ea9b4fa49bd1f998cb46

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Client.exe
                Filesize

                159KB

                MD5

                ecca6b799f217842229d175a695d2993

                SHA1

                232d3b92b25224f6b97e961a10fc0175163f4cc4

                SHA256

                93e90ecd12401fad5032a113663d81cab58aa137c4baafb1628ef71c4c27ffb1

                SHA512

                6367675cb3f86b06c23854bfb829f92cb084caf34592038236d33110267938f9e97982f290dea819febcc66bb08e334ac4f170bd6664ea9b4fa49bd1f998cb46

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Client.exe
                Filesize

                159KB

                MD5

                ecca6b799f217842229d175a695d2993

                SHA1

                232d3b92b25224f6b97e961a10fc0175163f4cc4

                SHA256

                93e90ecd12401fad5032a113663d81cab58aa137c4baafb1628ef71c4c27ffb1

                SHA512

                6367675cb3f86b06c23854bfb829f92cb084caf34592038236d33110267938f9e97982f290dea819febcc66bb08e334ac4f170bd6664ea9b4fa49bd1f998cb46

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Client.exe
                Filesize

                159KB

                MD5

                ecca6b799f217842229d175a695d2993

                SHA1

                232d3b92b25224f6b97e961a10fc0175163f4cc4

                SHA256

                93e90ecd12401fad5032a113663d81cab58aa137c4baafb1628ef71c4c27ffb1

                SHA512

                6367675cb3f86b06c23854bfb829f92cb084caf34592038236d33110267938f9e97982f290dea819febcc66bb08e334ac4f170bd6664ea9b4fa49bd1f998cb46

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Services.url
                Filesize

                176B

                MD5

                f07bc1dce1490494825737ec642700f0

                SHA1

                286877ffebff982ffd1e5e858120402a306908c5

                SHA256

                8f2f0cd367ef69419f94cbfd4e44e09191da6625cb2589f4b2b85e7536531bb1

                SHA512

                4bafad354184ed515898c6ec90a78a3e208b08b944fb2351839086bb869ff80345d2835f48e9484caac1ff40bfce02207f23ace8591c33db5b69c668a95e2a2f

                Download Submit

              • memory/3252-166-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3252-156-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3252-155-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3252-157-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3252-154-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3252-173-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3252-150-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3252-151-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3252-152-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3252-153-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4288-140-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4288-136-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4288-139-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4288-138-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4288-137-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4288-134-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4288-135-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4288-133-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4380-161-0x0000000000FF0000-0x0000000001000000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4380-165-0x0000000000FF0000-0x0000000001000000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4380-167-0x0000000000FF0000-0x0000000001000000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4380-168-0x0000000000FF0000-0x0000000001000000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4380-169-0x0000000000FF0000-0x0000000001000000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4380-160-0x0000000000FF0000-0x0000000001000000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4380-171-0x0000000000FF0000-0x0000000001000000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4380-159-0x0000000000FF0000-0x0000000001000000-memory.dmp

                Filesize

                64KB

                Download