njrat | 9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/09/2023, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453.exe
Size

37KB
MD5

07a2800cf83999d10ef1547c12b6d9f4
SHA1

8f5322620f7fc368a292275c1c5faaffb7e6d66e
SHA256

9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453
SHA512

078bf70ff41fc5120f44fd4bee960d274a808d66a6541b1afcc145c8e126093fe9f85d2c784ddb868a9d6b41b193bb44105558c3775ecfcd5c3f8255f1836eca
SSDEEP

384:ZnL+Yw7BeAaXaEiVZzdmB0O4yUvPQxgp+Z2fPnYL/6qUtirAF+rMRTyN/0L+Ecor:l6Yw7bPOTUvPfI3U8rM+rMRa8NuBMt

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

ctl-plg-ap-8.nsa.gov:443

Mutex

b2e30700dde72c163e3f2a5afaf275a9

Attributes

reg_key
b2e30700dde72c163e3f2a5afaf275a9
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1604	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2628	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2700	9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\b2e30700dde72c163e3f2a5afaf275a9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b2e30700dde72c163e3f2a5afaf275a9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .."	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	svchost.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe
Token: 33	2628	svchost.exe
Token: SeIncBasePriorityPrivilege	2628	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2628	2700	9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453.exe	28
PID 2700 wrote to memory of 2628	2700	9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453.exe	28
PID 2700 wrote to memory of 2628	2700	9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453.exe	28
PID 2700 wrote to memory of 2628	2700	9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453.exe	28
PID 2628 wrote to memory of 1604	2628	svchost.exe	29
PID 2628 wrote to memory of 1604	2628	svchost.exe	29
PID 2628 wrote to memory of 1604	2628	svchost.exe	29
PID 2628 wrote to memory of 1604	2628	svchost.exe	29

C:\Users\Admin\AppData\Local\Temp\9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453.exe
"C:\Users\Admin\AppData\Local\Temp\9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
37KB

MD5
07a2800cf83999d10ef1547c12b6d9f4

SHA1
8f5322620f7fc368a292275c1c5faaffb7e6d66e

SHA256
9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453

SHA512
078bf70ff41fc5120f44fd4bee960d274a808d66a6541b1afcc145c8e126093fe9f85d2c784ddb868a9d6b41b193bb44105558c3775ecfcd5c3f8255f1836eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
37KB

MD5
07a2800cf83999d10ef1547c12b6d9f4

SHA1
8f5322620f7fc368a292275c1c5faaffb7e6d66e

SHA256
9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453

SHA512
078bf70ff41fc5120f44fd4bee960d274a808d66a6541b1afcc145c8e126093fe9f85d2c784ddb868a9d6b41b193bb44105558c3775ecfcd5c3f8255f1836eca

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
37KB

MD5
07a2800cf83999d10ef1547c12b6d9f4

SHA1
8f5322620f7fc368a292275c1c5faaffb7e6d66e

SHA256
9958d10f9d07d2ccd4be9beafe2f9f4cf845533fc93abd948efdb59940b97453

SHA512
078bf70ff41fc5120f44fd4bee960d274a808d66a6541b1afcc145c8e126093fe9f85d2c784ddb868a9d6b41b193bb44105558c3775ecfcd5c3f8255f1836eca

Download Submit
memory/2628-10-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2628-11-0x00000000020F0000-0x0000000002130000-memory.dmp

Filesize
256KB

Download
memory/2628-13-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-0-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-1-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-2-0x00000000004A0000-0x00000000004E0000-memory.dmp

Filesize
256KB

Download
memory/2700-12-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download