njrat | 91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67

General

Target

s.exe
Size

23KB
MD5

4d0542e1d74a6be9dae377b16ddacc17
SHA1

cb0e366897672385e2bcad2a8c98b038a8b6cd99
SHA256

91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67
SHA512

645594fc8e9823ca68e0cd70e60022b330c1b233a4e2938579b4ca7010bfa62d36e1300070d68f25c7af3c43c3e1742036ab6f81971880e239069bfe9e7e993e
SSDEEP

384:zslUlEvOEJ8xWwYJOMiOBZEdj1567gtwi5HhbQmRvR6JZlbw8hqIusZzZ0Hk:EeEvwIlLMRpcnuxE

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

43.249.38.36:5552

Mutex

1c214698f485e7d0799a81ebc3c171f7

Attributes

reg_key
1c214698f485e7d0799a81ebc3c171f7
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2348 netsh.exe

pid	process
2348	netsh.exe

Drops startup file 2 IoCs

Processes:

spur.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c214698f485e7d0799a81ebc3c171f7.exe	spur.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c214698f485e7d0799a81ebc3c171f7.exe	spur.exe

Executes dropped EXE 1 IoCs

Processes:

spur.exe

pid process

2656 spur.exe
Loads dropped DLL 1 IoCs

Processes:

s.exe

pid process

1708 s.exe

pid	process
2656	spur.exe

pid	process
1708	s.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

spur.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Windows\CurrentVersion\Run\1c214698f485e7d0799a81ebc3c171f7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\spur.exe\" .."	spur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1c214698f485e7d0799a81ebc3c171f7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\spur.exe\" .."	spur.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

spur.exe

description	pid	process
Token: SeDebugPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe
Token: 33	2656	spur.exe
Token: SeIncBasePriorityPrivilege	2656	spur.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

s.exespur.exe

description	pid	process	target process
PID 1708 wrote to memory of 2656	1708	s.exe	spur.exe
PID 1708 wrote to memory of 2656	1708	s.exe	spur.exe
PID 1708 wrote to memory of 2656	1708	s.exe	spur.exe
PID 1708 wrote to memory of 2656	1708	s.exe	spur.exe
PID 2656 wrote to memory of 2348	2656	spur.exe	netsh.exe
PID 2656 wrote to memory of 2348	2656	spur.exe	netsh.exe
PID 2656 wrote to memory of 2348	2656	spur.exe	netsh.exe
PID 2656 wrote to memory of 2348	2656	spur.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\s.exe
"C:\Users\Admin\AppData\Local\Temp\s.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\spur.exe
"C:\Users\Admin\AppData\Local\Temp\spur.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\spur.exe" "spur.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2348

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\spur.exe
Filesize
23KB

MD5
4d0542e1d74a6be9dae377b16ddacc17

SHA1
cb0e366897672385e2bcad2a8c98b038a8b6cd99

SHA256
91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67

SHA512
645594fc8e9823ca68e0cd70e60022b330c1b233a4e2938579b4ca7010bfa62d36e1300070d68f25c7af3c43c3e1742036ab6f81971880e239069bfe9e7e993e

Download Submit
C:\Users\Admin\AppData\Local\Temp\spur.exe
Filesize
23KB

MD5
4d0542e1d74a6be9dae377b16ddacc17

SHA1
cb0e366897672385e2bcad2a8c98b038a8b6cd99

SHA256
91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67

SHA512
645594fc8e9823ca68e0cd70e60022b330c1b233a4e2938579b4ca7010bfa62d36e1300070d68f25c7af3c43c3e1742036ab6f81971880e239069bfe9e7e993e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c214698f485e7d0799a81ebc3c171f7.exe
Filesize
23KB

MD5
4d0542e1d74a6be9dae377b16ddacc17

SHA1
cb0e366897672385e2bcad2a8c98b038a8b6cd99

SHA256
91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67

SHA512
645594fc8e9823ca68e0cd70e60022b330c1b233a4e2938579b4ca7010bfa62d36e1300070d68f25c7af3c43c3e1742036ab6f81971880e239069bfe9e7e993e

Download Submit
\Users\Admin\AppData\Local\Temp\spur.exe
Filesize
23KB

MD5
4d0542e1d74a6be9dae377b16ddacc17

SHA1
cb0e366897672385e2bcad2a8c98b038a8b6cd99

SHA256
91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67

SHA512
645594fc8e9823ca68e0cd70e60022b330c1b233a4e2938579b4ca7010bfa62d36e1300070d68f25c7af3c43c3e1742036ab6f81971880e239069bfe9e7e993e

Download Submit
memory/1708-1-0x0000000000130000-0x0000000000170000-memory.dmp

Filesize
256KB

Download
memory/1708-0-0x0000000074D10000-0x00000000752BB000-memory.dmp

Filesize
5.7MB

Download
memory/1708-2-0x0000000074D10000-0x00000000752BB000-memory.dmp

Filesize
5.7MB

Download
memory/1708-11-0x0000000074D10000-0x00000000752BB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-12-0x0000000001ED0000-0x0000000001F10000-memory.dmp

Filesize
256KB

Download
memory/2656-10-0x0000000074D10000-0x00000000752BB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-14-0x0000000074D10000-0x00000000752BB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads