njrat | 8539d8e44e928a23ef872c5a8ad4d4e632c9f489a013a5b29d36d15ac2767b61

General

Target

xV0aWLFtJKKg.exe
Size

78KB
MD5

5658dd93a8379d6c46126a380ceb8b50
SHA1

4de37a6d63ebd5f89a96eb8f832c12dbf21c38ce
SHA256

8539d8e44e928a23ef872c5a8ad4d4e632c9f489a013a5b29d36d15ac2767b61
SHA512

a355e0e5b0c8b9933233951758d63fedcf4c8813b84ba9844334e4b6c2eb5b30566294bcb5fd33f6684576b77175369214f2f469a66e0b6647331f81c93dafee
SSDEEP

1536:qpbXx+1CmYDp2S5wpOk3JCK6pFoETQ6fOpd/9nEh9TGGhJcR:OwQwpOk5CK6pO/9ESGhJc

Score

10^/10

njrat junio777 persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

JUNIO777

C2

verderesilencia.duckdns.org:2010

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
2023

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe

Executes dropped EXE 1 IoCs

pid	Process
1600	Client.exe

Loads dropped DLL 1 IoCs

pid	Process
1056	xV0aWLFtJKKg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .."	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .."	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1004	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	Client.exe
Token: 33	1600	Client.exe
Token: SeIncBasePriorityPrivilege	1600	Client.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1600	1056	xV0aWLFtJKKg.exe	27
PID 1056 wrote to memory of 1600	1056	xV0aWLFtJKKg.exe	27
PID 1056 wrote to memory of 1600	1056	xV0aWLFtJKKg.exe	27
PID 1056 wrote to memory of 1600	1056	xV0aWLFtJKKg.exe	27
PID 1600 wrote to memory of 480	1600	Client.exe	29
PID 1600 wrote to memory of 480	1600	Client.exe	29
PID 1600 wrote to memory of 480	1600	Client.exe	29
PID 1600 wrote to memory of 480	1600	Client.exe	29
PID 1600 wrote to memory of 892	1600	Client.exe	31
PID 1600 wrote to memory of 892	1600	Client.exe	31
PID 1600 wrote to memory of 892	1600	Client.exe	31
PID 1600 wrote to memory of 892	1600	Client.exe	31
PID 892 wrote to memory of 1004	892	cmd.exe	33
PID 892 wrote to memory of 1004	892	cmd.exe	33
PID 892 wrote to memory of 1004	892	cmd.exe	33
PID 892 wrote to memory of 1004	892	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\xV0aWLFtJKKg.exe
"C:\Users\Admin\AppData\Local\Temp\xV0aWLFtJKKg.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Client.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    PID:480
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\SysWOW64\PING.EXE
      ping 0 -n 2
      4⤵
      Runs ping.exe
      PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
78KB

MD5
5658dd93a8379d6c46126a380ceb8b50

SHA1
4de37a6d63ebd5f89a96eb8f832c12dbf21c38ce

SHA256
8539d8e44e928a23ef872c5a8ad4d4e632c9f489a013a5b29d36d15ac2767b61

SHA512
a355e0e5b0c8b9933233951758d63fedcf4c8813b84ba9844334e4b6c2eb5b30566294bcb5fd33f6684576b77175369214f2f469a66e0b6647331f81c93dafee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
78KB

MD5
5658dd93a8379d6c46126a380ceb8b50

SHA1
4de37a6d63ebd5f89a96eb8f832c12dbf21c38ce

SHA256
8539d8e44e928a23ef872c5a8ad4d4e632c9f489a013a5b29d36d15ac2767b61

SHA512
a355e0e5b0c8b9933233951758d63fedcf4c8813b84ba9844334e4b6c2eb5b30566294bcb5fd33f6684576b77175369214f2f469a66e0b6647331f81c93dafee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe

Filesize
78KB

MD5
5658dd93a8379d6c46126a380ceb8b50

SHA1
4de37a6d63ebd5f89a96eb8f832c12dbf21c38ce

SHA256
8539d8e44e928a23ef872c5a8ad4d4e632c9f489a013a5b29d36d15ac2767b61

SHA512
a355e0e5b0c8b9933233951758d63fedcf4c8813b84ba9844334e4b6c2eb5b30566294bcb5fd33f6684576b77175369214f2f469a66e0b6647331f81c93dafee

Download Submit
\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
78KB

MD5
5658dd93a8379d6c46126a380ceb8b50

SHA1
4de37a6d63ebd5f89a96eb8f832c12dbf21c38ce

SHA256
8539d8e44e928a23ef872c5a8ad4d4e632c9f489a013a5b29d36d15ac2767b61

SHA512
a355e0e5b0c8b9933233951758d63fedcf4c8813b84ba9844334e4b6c2eb5b30566294bcb5fd33f6684576b77175369214f2f469a66e0b6647331f81c93dafee

Download Submit
memory/1056-54-0x0000000000480000-0x00000000004C0000-memory.dmp

Filesize
256KB

Download
memory/1600-62-0x0000000000870000-0x00000000008B0000-memory.dmp

Filesize
256KB

Download
memory/1600-64-0x0000000000870000-0x00000000008B0000-memory.dmp

Filesize
256KB

Download
memory/1600-65-0x0000000000870000-0x00000000008B0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing