njrat | 2b44054c257780f0297d3a39d48a8fddbd2a2c6e047b4d25dcbb33fdaf0cd7b7

General

Target

1660-14-0x0000000000610000-0x0000000000650000-memory.exe
Size

256KB
MD5

df354d41cb9eeb6064629f54aa243450
SHA1

b6056d4453385349d020fcf447bf19fccc800570
SHA256

2b44054c257780f0297d3a39d48a8fddbd2a2c6e047b4d25dcbb33fdaf0cd7b7
SHA512

5e3460ab89943032670eef6478587607a9658b1548b2a5596955b1209df452ac3795c35002c735fc16c441a11d01efecbcb42234cf29da46fc5750c788943ed3
SSDEEP

1536:zvKO+4jwQVkLjMvBngxp0ICzoWdLGCQIXI1wEBn2a3pb4rw2UlvLf:99wTLagxp0IqoqnI1wg9Gr/Ut

Score

10^/10

njrat system evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

system

C2

147.50.253.241:6522

Mutex

e4d8b898672502b9751c26f7a748bd76

Attributes

reg_key
e4d8b898672502b9751c26f7a748bd76
splitter
Y262SUCZ4UJJ

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2508 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

system.exe

pid process

2204 system.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2508	netsh.exe

pid	process
2204	system.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

system.exe

description	pid	process
Token: SeDebugPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe
Token: 33	2204	system.exe
Token: SeIncBasePriorityPrivilege	2204	system.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1660-14-0x0000000000610000-0x0000000000650000-memory.exesystem.exe

description	pid	process	target process
PID 1712 wrote to memory of 2204	1712	1660-14-0x0000000000610000-0x0000000000650000-memory.exe	system.exe
PID 1712 wrote to memory of 2204	1712	1660-14-0x0000000000610000-0x0000000000650000-memory.exe	system.exe
PID 1712 wrote to memory of 2204	1712	1660-14-0x0000000000610000-0x0000000000650000-memory.exe	system.exe
PID 2204 wrote to memory of 2508	2204	system.exe	netsh.exe
PID 2204 wrote to memory of 2508	2204	system.exe	netsh.exe
PID 2204 wrote to memory of 2508	2204	system.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\1660-14-0x0000000000610000-0x0000000000650000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1660-14-0x0000000000610000-0x0000000000650000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Local\Temp\system.exe
"C:\Users\Admin\AppData\Local\Temp\system.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\system.exe" "system.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2508

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\system.exe
Filesize
256KB

MD5
df354d41cb9eeb6064629f54aa243450

SHA1
b6056d4453385349d020fcf447bf19fccc800570

SHA256
2b44054c257780f0297d3a39d48a8fddbd2a2c6e047b4d25dcbb33fdaf0cd7b7

SHA512
5e3460ab89943032670eef6478587607a9658b1548b2a5596955b1209df452ac3795c35002c735fc16c441a11d01efecbcb42234cf29da46fc5750c788943ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe
Filesize
256KB

MD5
df354d41cb9eeb6064629f54aa243450

SHA1
b6056d4453385349d020fcf447bf19fccc800570

SHA256
2b44054c257780f0297d3a39d48a8fddbd2a2c6e047b4d25dcbb33fdaf0cd7b7

SHA512
5e3460ab89943032670eef6478587607a9658b1548b2a5596955b1209df452ac3795c35002c735fc16c441a11d01efecbcb42234cf29da46fc5750c788943ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe
Filesize
256KB

MD5
df354d41cb9eeb6064629f54aa243450

SHA1
b6056d4453385349d020fcf447bf19fccc800570

SHA256
2b44054c257780f0297d3a39d48a8fddbd2a2c6e047b4d25dcbb33fdaf0cd7b7

SHA512
5e3460ab89943032670eef6478587607a9658b1548b2a5596955b1209df452ac3795c35002c735fc16c441a11d01efecbcb42234cf29da46fc5750c788943ed3

Download Submit
memory/1712-0-0x0000000075080000-0x0000000075631000-memory.dmp

Filesize
5.7MB

Download
memory/1712-1-0x0000000075080000-0x0000000075631000-memory.dmp

Filesize
5.7MB

Download
memory/1712-2-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/1712-12-0x0000000075080000-0x0000000075631000-memory.dmp

Filesize
5.7MB

Download
memory/2204-13-0x0000000075080000-0x0000000075631000-memory.dmp

Filesize
5.7MB

Download
memory/2204-14-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download
memory/2204-15-0x0000000075080000-0x0000000075631000-memory.dmp

Filesize
5.7MB

Download
memory/2204-16-0x0000000075080000-0x0000000075631000-memory.dmp

Filesize
5.7MB

Download
memory/2204-17-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing