njrat | 90513b75e86063db47f5ab12981e611e1bdad8bd094c062c6c61aa761d7de8fa

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mrnjhdf.bin.exe
Size

374KB
MD5

ba576a58775f397175afb3c6489ce7a6
SHA1

1d360275e14ba307b8d890df12dbab3d3c1a46c2
SHA256

90513b75e86063db47f5ab12981e611e1bdad8bd094c062c6c61aa761d7de8fa
SHA512

e503cb59d691fcf135442e99eba39b01ce908eae0625d7484f35055275090746e60ec60e0734e342a4c7a02aebeb20f6e2781da9a1409d24c4d6c5a855a06372
SSDEEP

6144:RruzpT9ioSfQd74QdWRoOamLIZC4M9w2GoS7ura8cWrafmJDR9a:gz/ioTbuoOaeh4M9QoNr7ymJDR9

Score

10^/10

njrat nyan cat trojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

nj0509.duckdns.org:0509

Mutex

6ce9672712ba4490be

Attributes

reg_key
6ce9672712ba4490be
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mrnjhdf.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mrnjhdf.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3288 set thread context of 2772	3288	mrnjhdf.bin.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4568	Powershell.exe
4568	Powershell.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	Powershell.exe
Token: SeDebugPrivilege	3288	mrnjhdf.bin.exe
Token: SeDebugPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe
Token: 33	2772	InstallUtil.exe
Token: SeIncBasePriorityPrivilege	2772	InstallUtil.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4568	3288	mrnjhdf.bin.exe	84
PID 3288 wrote to memory of 4568	3288	mrnjhdf.bin.exe	84
PID 3288 wrote to memory of 4568	3288	mrnjhdf.bin.exe	84
PID 3288 wrote to memory of 2772	3288	mrnjhdf.bin.exe	86
PID 3288 wrote to memory of 2772	3288	mrnjhdf.bin.exe	86
PID 3288 wrote to memory of 2772	3288	mrnjhdf.bin.exe	86
PID 3288 wrote to memory of 2772	3288	mrnjhdf.bin.exe	86
PID 3288 wrote to memory of 2772	3288	mrnjhdf.bin.exe	86
PID 3288 wrote to memory of 2772	3288	mrnjhdf.bin.exe	86
PID 3288 wrote to memory of 2772	3288	mrnjhdf.bin.exe	86
PID 3288 wrote to memory of 2772	3288	mrnjhdf.bin.exe	86

C:\Users\Admin\AppData\Local\Temp\mrnjhdf.bin.exe
"C:\Users\Admin\AppData\Local\Temp\mrnjhdf.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\mrnjhdf.bin.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mrnjhdf.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fr5xe4of.dle.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2772-217-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/2772-216-0x0000000005A10000-0x0000000005A1A000-memory.dmp

Filesize
40KB

Download
memory/2772-215-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/2772-207-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3288-197-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-133-0x0000000000A90000-0x0000000000AF4000-memory.dmp

Filesize
400KB

Download
memory/3288-134-0x0000000005B30000-0x00000000060D4000-memory.dmp

Filesize
5.6MB

Download
memory/3288-135-0x00000000054A0000-0x0000000005532000-memory.dmp

Filesize
584KB

Download
memory/3288-136-0x0000000005970000-0x0000000005982000-memory.dmp

Filesize
72KB

Download
memory/3288-138-0x0000000005A30000-0x0000000005ACC000-memory.dmp

Filesize
624KB

Download
memory/3288-137-0x0000000005410000-0x0000000005420000-memory.dmp

Filesize
64KB

Download
memory/3288-206-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download
memory/3288-205-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-155-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-156-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-158-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-160-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-162-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-164-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-166-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-168-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-170-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-172-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-174-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-180-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-203-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-178-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-182-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-184-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-186-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-188-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-201-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-190-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-193-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-195-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-176-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/3288-199-0x0000000005990000-0x00000000059B3000-memory.dmp

Filesize
140KB

Download
memory/4568-191-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Filesize
120KB

Download
memory/4568-139-0x0000000004950000-0x0000000004986000-memory.dmp

Filesize
216KB

Download
memory/4568-150-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/4568-143-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download
memory/4568-149-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/4568-209-0x0000000006460000-0x00000000064F6000-memory.dmp

Filesize
600KB

Download
memory/4568-210-0x00000000063C0000-0x00000000063DA000-memory.dmp

Filesize
104KB

Download
memory/4568-211-0x0000000006410000-0x0000000006432000-memory.dmp

Filesize
136KB

Download
memory/4568-142-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/4568-141-0x0000000005640000-0x0000000005662000-memory.dmp

Filesize
136KB

Download
memory/4568-140-0x0000000004FE0000-0x0000000005608000-memory.dmp

Filesize
6.2MB

Download