njrat | 871978fb97af5fca44a98714b79a3e86dfdb468eed6980dadc7f2bf7e5bf1aaa

Resubmissions

06/11/2023, 19:37

231106-ybwfxadf81 10

06/11/2023, 19:33

231106-x9tjjadf4z 10

06/11/2023, 16:18

231106-tr58tscc9y 10

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1106-11-Njrat.exe
Size

2.7MB
MD5

f6e3aee1f90ebd9fd2035d95cfb1572a
SHA1

9e3f5dd7421c68ed101a21678056a0d03a145d1a
SHA256

0b4d4ccbb9bef35964350e889dd87d2f5b0cd4e0fdc281af1f11adfbce994209
SHA512

437a0a1a485cc07567e149a5de503b2d2312925695824c002d25ad51a7015cfd78c03c962bbcd808793387d7cb3b4008602c70909a067ca29ac18827c5360035
SSDEEP

49152:rBZ6v3/0HTj169yWEY969K22VwFHITeeAwxkA:rWv3/0HTj169yWEY969r2VeH

Score

10^/10

njrat zgrat hi can you give money persistence rat trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

Hi can you give money

172.94.4.171:7772

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral21/memory/1280-3-0x0000000002140000-0x000000000217A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk	1106-11-Njrat.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	RegAsm.exe

Executes dropped EXE 1 IoCs

pid	Process
2700	Adobe Reader PDF.exe

Loads dropped DLL 1 IoCs

pid	Process
2864	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Reader PDF.exe"	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1280 set thread context of 2864	1280	1106-11-Njrat.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 1280 wrote to memory of 2864	1280	1106-11-Njrat.exe	28
PID 2864 wrote to memory of 2700	2864	RegAsm.exe	29
PID 2864 wrote to memory of 2700	2864	RegAsm.exe	29
PID 2864 wrote to memory of 2700	2864	RegAsm.exe	29
PID 2864 wrote to memory of 2700	2864	RegAsm.exe	29
PID 2864 wrote to memory of 3040	2864	RegAsm.exe	31
PID 2864 wrote to memory of 3040	2864	RegAsm.exe	31
PID 2864 wrote to memory of 3040	2864	RegAsm.exe	31
PID 2864 wrote to memory of 3040	2864	RegAsm.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3040	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1106-11-Njrat.exe
"C:\Users\Admin\AppData\Local\Temp\1106-11-Njrat.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Roaming\Adobe Reader PDF.exe
    "C:\Users\Admin\AppData\Roaming\Adobe Reader PDF.exe"
    3⤵
    - Executes dropped EXE
    PID:2700
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Adobe Reader PDF.exe"
    3⤵
    - Views/modifies file attributes
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe Reader PDF.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe Reader PDF.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
\Users\Admin\AppData\Roaming\Adobe Reader PDF.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
memory/1280-17-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/1280-0-0x0000000000240000-0x00000000004F2000-memory.dmp

Filesize
2.7MB

Download
memory/1280-3-0x0000000002140000-0x000000000217A000-memory.dmp

Filesize
232KB

Download
memory/1280-1-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/2700-28-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2700-27-0x0000000000130000-0x0000000000142000-memory.dmp

Filesize
72KB

Download
memory/2864-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2864-16-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2864-14-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2864-12-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2864-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2864-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2864-4-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads