njrat | 55ebf6e1cf3205a0856278c48d7db5ad8c09d6349dd4dacb2ba29e28414b3e5f

Analysis

max time kernel
53s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2023 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vir.exe
Size

88KB
MD5

74b0eb7d15999dd0886e3a9b8616a5ca
SHA1

8ec77322cdd5a708e0aa22c830fe368770b12e6b
SHA256

55ebf6e1cf3205a0856278c48d7db5ad8c09d6349dd4dacb2ba29e28414b3e5f
SHA512

1e863277ef675dba35a3f1924b556f3980ad6f0cb1648e62e8ee1f8fec52eb752e5f6d757c28442e21f165f877562d6a8229cc276e30d80d79069f1e546a0779
SSDEEP

1536:s6GqLMyrR2t1Kz66wDCiX+ioXGAbhoZgmFcH0lGTnZKYWjFxCuxm9L:7L7rR2t1ooD+fnhoZgmFrGtEFxC/9L

Score

10^/10

njrat xworm backup rat trojan

Malware Config

Extracted

Family

xworm

opportunities-rendered.craft.ply.gg:39858

Attributes

install_file
ctfmon.exe

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

BackUp

style-camps.craft.ply.gg:37572

Mutex

Text attrib corrector

Attributes

reg_key
Text attrib corrector
splitter
|Hassan|

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

vir.exectfmon.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\International\Geo\Nation	vir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\International\Geo\Nation	ctfmon.exe

Executes dropped EXE 4 IoCs

Processes:

ctfmon.exeTextInputService.exeServer.exectfmon.exe

pid process

2264 ctfmon.exe
388 TextInputService.exe
1300 Server.exe
2572 ctfmon.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
11	ip-api.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1712 schtasks.exe
4732 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1396 timeout.exe

pid	process
1712	schtasks.exe
4732	schtasks.exe

pid	process
1396	timeout.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

Processes:

ctfmon.exetaskmgr.exe

pid	process
2264	ctfmon.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

TextInputService.exe

pid process

388 TextInputService.exe

pid	process
388	TextInputService.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

vir.exectfmon.exetaskmgr.exeTextInputService.exectfmon.exe

description	pid	process
Token: SeDebugPrivilege	1984	vir.exe
Token: SeDebugPrivilege	2264	ctfmon.exe
Token: SeDebugPrivilege	5032	taskmgr.exe
Token: SeSystemProfilePrivilege	5032	taskmgr.exe
Token: SeCreateGlobalPrivilege	5032	taskmgr.exe
Token: SeDebugPrivilege	388	TextInputService.exe
Token: 33	388	TextInputService.exe
Token: SeIncBasePriorityPrivilege	388	TextInputService.exe
Token: 33	388	TextInputService.exe
Token: SeIncBasePriorityPrivilege	388	TextInputService.exe
Token: SeDebugPrivilege	2572	ctfmon.exe
Token: 33	388	TextInputService.exe
Token: SeIncBasePriorityPrivilege	388	TextInputService.exe

Suspicious use of FindShellTrayWindow 46 IoCs

Processes:

taskmgr.exe

pid	process
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe

Suspicious use of SendNotifyMessage 46 IoCs

Processes:

taskmgr.exe

pid	process
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe
5032	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ctfmon.exe

pid process

2264 ctfmon.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

vir.execmd.exectfmon.exeTextInputService.exe

description	pid	process	target process
PID 1984 wrote to memory of 2264	1984	vir.exe	ctfmon.exe
PID 1984 wrote to memory of 2264	1984	vir.exe	ctfmon.exe
PID 1984 wrote to memory of 388	1984	vir.exe	TextInputService.exe
PID 1984 wrote to memory of 388	1984	vir.exe	TextInputService.exe
PID 1984 wrote to memory of 388	1984	vir.exe	TextInputService.exe
PID 1984 wrote to memory of 1968	1984	vir.exe	cmd.exe
PID 1984 wrote to memory of 1968	1984	vir.exe	cmd.exe
PID 1968 wrote to memory of 1396	1968	cmd.exe	timeout.exe
PID 1968 wrote to memory of 1396	1968	cmd.exe	timeout.exe
PID 2264 wrote to memory of 1712	2264	ctfmon.exe	schtasks.exe
PID 2264 wrote to memory of 1712	2264	ctfmon.exe	schtasks.exe
PID 388 wrote to memory of 4732	388	TextInputService.exe	schtasks.exe
PID 388 wrote to memory of 4732	388	TextInputService.exe	schtasks.exe
PID 388 wrote to memory of 4732	388	TextInputService.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\vir.exe
"C:\Users\Admin\AppData\Local\Temp\vir.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984

C:\ProgramData\ctfmon.exe
"C:\ProgramData\ctfmon.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ctfmon" /tr "C:\ProgramData\ctfmon.exe"
3⤵
- Creates scheduled task(s)
PID:1712

C:\Users\Admin\TextInputService.exe
"C:\Users\Admin\TextInputService.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
3⤵
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp937B.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1396

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5032

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:1300

C:\ProgramData\ctfmon.exe
C:\ProgramData\ctfmon.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ctfmon.exe
Filesize
77KB

MD5
93f43d8e769a86186535cd664c58e651

SHA1
f8100fc2f721e0d10fa8b37d83361499d6efbddc

SHA256
c5008f5e5f24e0d33182a605b8ce82b12b487d9d3d35343289ccc2aa2bc370dc

SHA512
fe8c055230291c5e7c3866ddfc8801fadefcd41d72b4d3db13d1d6362d7f65d0810f4894a207378d1347c4fb8d0f1964272f0f36a1672daee867284b29d55298

Download Submit
C:\ProgramData\ctfmon.exe
Filesize
77KB

MD5
93f43d8e769a86186535cd664c58e651

SHA1
f8100fc2f721e0d10fa8b37d83361499d6efbddc

SHA256
c5008f5e5f24e0d33182a605b8ce82b12b487d9d3d35343289ccc2aa2bc370dc

SHA512
fe8c055230291c5e7c3866ddfc8801fadefcd41d72b4d3db13d1d6362d7f65d0810f4894a207378d1347c4fb8d0f1964272f0f36a1672daee867284b29d55298

Download Submit
C:\ProgramData\ctfmon.exe
Filesize
77KB

MD5
93f43d8e769a86186535cd664c58e651

SHA1
f8100fc2f721e0d10fa8b37d83361499d6efbddc

SHA256
c5008f5e5f24e0d33182a605b8ce82b12b487d9d3d35343289ccc2aa2bc370dc

SHA512
fe8c055230291c5e7c3866ddfc8801fadefcd41d72b4d3db13d1d6362d7f65d0810f4894a207378d1347c4fb8d0f1964272f0f36a1672daee867284b29d55298

Download Submit
C:\ProgramData\ctfmon.exe
Filesize
77KB

MD5
93f43d8e769a86186535cd664c58e651

SHA1
f8100fc2f721e0d10fa8b37d83361499d6efbddc

SHA256
c5008f5e5f24e0d33182a605b8ce82b12b487d9d3d35343289ccc2aa2bc370dc

SHA512
fe8c055230291c5e7c3866ddfc8801fadefcd41d72b4d3db13d1d6362d7f65d0810f4894a207378d1347c4fb8d0f1964272f0f36a1672daee867284b29d55298

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
3c8917c8a63b3b3458573f1b43cdca38

SHA1
735cbbbe79f9002e5d8c9e360624ec215b14ad36

SHA256
b71d1ff924bc9938396c694fdbeb28901aaba471fb0b719ad91a8887dc605df7

SHA512
58cf1d0965d40601df372917b15610f66bd600e8297f176702688dd11ad474f1e1cd0094240a00832e38fb40c1b4ad14b2a4f45fb8c8b1a8957b969172815fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe
Filesize
43KB

MD5
3c8917c8a63b3b3458573f1b43cdca38

SHA1
735cbbbe79f9002e5d8c9e360624ec215b14ad36

SHA256
b71d1ff924bc9938396c694fdbeb28901aaba471fb0b719ad91a8887dc605df7

SHA512
58cf1d0965d40601df372917b15610f66bd600e8297f176702688dd11ad474f1e1cd0094240a00832e38fb40c1b4ad14b2a4f45fb8c8b1a8957b969172815fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp937B.tmp.bat
Filesize
155B

MD5
f27b65c0ad5c4bb7dc5eab9e916d1af2

SHA1
49c94678aab17a47d80333a49620505e0c1195d2

SHA256
13223d452a94647dc0ca49143e08d35bab01d330cab81f4a7d1911f51fb78ff2

SHA512
f16cb5151413bd1ca7a07084cd3d284acba6ad0f6869bb6ff24536bfbfb481140edc7342975d27fbc7f2828b16817d78836afa07614cfdb4f892e295a3844699

Download Submit
C:\Users\Admin\TextInputService.exe
Filesize
43KB

MD5
3c8917c8a63b3b3458573f1b43cdca38

SHA1
735cbbbe79f9002e5d8c9e360624ec215b14ad36

SHA256
b71d1ff924bc9938396c694fdbeb28901aaba471fb0b719ad91a8887dc605df7

SHA512
58cf1d0965d40601df372917b15610f66bd600e8297f176702688dd11ad474f1e1cd0094240a00832e38fb40c1b4ad14b2a4f45fb8c8b1a8957b969172815fd9

Download Submit
C:\Users\Admin\TextInputService.exe
Filesize
43KB

MD5
3c8917c8a63b3b3458573f1b43cdca38

SHA1
735cbbbe79f9002e5d8c9e360624ec215b14ad36

SHA256
b71d1ff924bc9938396c694fdbeb28901aaba471fb0b719ad91a8887dc605df7

SHA512
58cf1d0965d40601df372917b15610f66bd600e8297f176702688dd11ad474f1e1cd0094240a00832e38fb40c1b4ad14b2a4f45fb8c8b1a8957b969172815fd9

Download Submit
C:\Users\Admin\TextInputService.exe
Filesize
43KB

MD5
3c8917c8a63b3b3458573f1b43cdca38

SHA1
735cbbbe79f9002e5d8c9e360624ec215b14ad36

SHA256
b71d1ff924bc9938396c694fdbeb28901aaba471fb0b719ad91a8887dc605df7

SHA512
58cf1d0965d40601df372917b15610f66bd600e8297f176702688dd11ad474f1e1cd0094240a00832e38fb40c1b4ad14b2a4f45fb8c8b1a8957b969172815fd9

Download Submit
memory/388-178-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/388-180-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/388-196-0x0000000005A40000-0x0000000005A4A000-memory.dmp

Filesize
40KB

Download
memory/388-177-0x0000000005AE0000-0x0000000005B72000-memory.dmp

Filesize
584KB

Download
memory/388-174-0x0000000000CC0000-0x0000000000CD2000-memory.dmp

Filesize
72KB

Download
memory/388-175-0x0000000005620000-0x00000000056BC000-memory.dmp

Filesize
624KB

Download
memory/388-176-0x0000000005FF0000-0x0000000006594000-memory.dmp

Filesize
5.6MB

Download
memory/1300-200-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/1984-137-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

Filesize
64KB

Download
memory/1984-133-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

Filesize
64KB

Download
memory/1984-168-0x000000001CCD0000-0x000000001D19E000-memory.dmp

Filesize
4.8MB

Download
memory/1984-136-0x000000001B1E0000-0x000000001B242000-memory.dmp

Filesize
392KB

Download
memory/1984-135-0x000000001B090000-0x000000001B136000-memory.dmp

Filesize
664KB

Download
memory/1984-134-0x0000000000160000-0x000000000017A000-memory.dmp

Filesize
104KB

Download
memory/2264-165-0x00000000008C0000-0x00000000008DA000-memory.dmp

Filesize
104KB

Download
memory/2264-182-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

Filesize
64KB

Download
memory/2264-179-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

Filesize
64KB

Download
memory/5032-189-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download
memory/5032-190-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download
memory/5032-191-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download
memory/5032-192-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download
memory/5032-193-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download
memory/5032-195-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download
memory/5032-194-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download
memory/5032-185-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download
memory/5032-184-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download
memory/5032-183-0x0000027917020000-0x0000027917021000-memory.dmp

Filesize
4KB

Download