njrat | 7e0116704c18518cb8f6a60fb00aa9440e61c079701bf816b52c155c748eda48

Analysis

max time kernel
1801s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2023, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Payload.exe
Size

27KB
MD5

8ab054d88fcdce1bc76e2ae57464a09b
SHA1

9995afbba5a6b346fcfd66eee2f335130a1311c0
SHA256

7e0116704c18518cb8f6a60fb00aa9440e61c079701bf816b52c155c748eda48
SHA512

5944fb371c6d70b97c9325a057e1b741f00db8dfbf43f3366c1cdf13c7f9fd8acda67f77e329394444f8fe4d6a45eae55bb77084d869eba8c33940cd3cf591ce
SSDEEP

384:qLLQKJ3buZjmgERA40DwoyumGPiJRjMFAQk93vmhm7UMKmIEecKdbXTzm9bVhcag:0MK5buQE40fLFA/vMHTi9bD

Score

10^/10

njrat victim persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

Victim

147.185.221.181:51752

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	attrib.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4132	Payload.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe
Token: SeIncBasePriorityPrivilege	4132	Payload.exe
Token: 33	4132	Payload.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 680	4132	Payload.exe	92
PID 4132 wrote to memory of 680	4132	Payload.exe	92
PID 4132 wrote to memory of 680	4132	Payload.exe	92
PID 4132 wrote to memory of 3868	4132	Payload.exe	93
PID 4132 wrote to memory of 3868	4132	Payload.exe	93
PID 4132 wrote to memory of 3868	4132	Payload.exe	93

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
680	attrib.exe
3868	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
  2⤵
  - Drops startup file
  - Views/modifies file attributes
  PID:680
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
  2⤵
  - Views/modifies file attributes
  PID:3868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe

Filesize
27KB

MD5
8ab054d88fcdce1bc76e2ae57464a09b

SHA1
9995afbba5a6b346fcfd66eee2f335130a1311c0

SHA256
7e0116704c18518cb8f6a60fb00aa9440e61c079701bf816b52c155c748eda48

SHA512
5944fb371c6d70b97c9325a057e1b741f00db8dfbf43f3366c1cdf13c7f9fd8acda67f77e329394444f8fe4d6a45eae55bb77084d869eba8c33940cd3cf591ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe

Filesize
27KB

MD5
8ab054d88fcdce1bc76e2ae57464a09b

SHA1
9995afbba5a6b346fcfd66eee2f335130a1311c0

SHA256
7e0116704c18518cb8f6a60fb00aa9440e61c079701bf816b52c155c748eda48

SHA512
5944fb371c6d70b97c9325a057e1b741f00db8dfbf43f3366c1cdf13c7f9fd8acda67f77e329394444f8fe4d6a45eae55bb77084d869eba8c33940cd3cf591ce

Download Submit
memory/4132-133-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4132-134-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4132-135-0x0000000000F40000-0x0000000000F50000-memory.dmp

Filesize
64KB

Download
memory/4132-138-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4132-139-0x0000000000F40000-0x0000000000F50000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads