njrat | 557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28d

Analysis

max time kernel
30s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2023, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe
Size

43KB
MD5

aa91557978aa60bc7bf9d84471e119d4
SHA1

b7dd12b6219cc1157c91c1afc913b138cc170b66
SHA256

557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28d
SHA512

8a8971c7f0211de2b41eaacf4f2d397a7ab617f7e5f76acd5b49b160952d92e92cf3537d604b939b1cc4b4dcb07e2c102b00f98d76083f435e022d87064dca55
SSDEEP

384:yZyzSg98NaIyrLPb3cWESES6ik7azsIij+ZsNO3PlpJKkkjh/TzF7pWnk/greT0k:A4ywFrzb3cP7QuXQ/oh/+L

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

4.tcp.eu.ngrok.io:11176

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
4964	Server.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4716	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2956	557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe
Token: 33	2956	557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe
Token: SeIncBasePriorityPrivilege	2956	557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4716	2956	557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe	90
PID 2956 wrote to memory of 4716	2956	557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe	90
PID 2956 wrote to memory of 4716	2956	557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe	90

C:\Users\Admin\AppData\Local\Temp\557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28dexe_JC.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
  2⤵
  - Creates scheduled task(s)
  PID:4716

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
43KB

MD5
aa91557978aa60bc7bf9d84471e119d4

SHA1
b7dd12b6219cc1157c91c1afc913b138cc170b66

SHA256
557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28d

SHA512
8a8971c7f0211de2b41eaacf4f2d397a7ab617f7e5f76acd5b49b160952d92e92cf3537d604b939b1cc4b4dcb07e2c102b00f98d76083f435e022d87064dca55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
43KB

MD5
aa91557978aa60bc7bf9d84471e119d4

SHA1
b7dd12b6219cc1157c91c1afc913b138cc170b66

SHA256
557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28d

SHA512
8a8971c7f0211de2b41eaacf4f2d397a7ab617f7e5f76acd5b49b160952d92e92cf3537d604b939b1cc4b4dcb07e2c102b00f98d76083f435e022d87064dca55

Download Submit
memory/2956-133-0x0000000000D10000-0x0000000000D22000-memory.dmp

Filesize
72KB

Download
memory/2956-134-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/2956-135-0x00000000056C0000-0x000000000575C000-memory.dmp

Filesize
624KB

Download
memory/2956-136-0x0000000005900000-0x0000000005910000-memory.dmp

Filesize
64KB

Download
memory/2956-137-0x0000000005FC0000-0x0000000006564000-memory.dmp

Filesize
5.6MB

Download
memory/2956-138-0x0000000005AF0000-0x0000000005B82000-memory.dmp

Filesize
584KB

Download
memory/2956-140-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/2956-141-0x0000000005900000-0x0000000005910000-memory.dmp

Filesize
64KB

Download
memory/2956-142-0x0000000005AE0000-0x0000000005AEA000-memory.dmp

Filesize
40KB

Download
memory/4964-145-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads