njrat | 91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67

General

Target

s.exe
Size

23KB
MD5

4d0542e1d74a6be9dae377b16ddacc17
SHA1

cb0e366897672385e2bcad2a8c98b038a8b6cd99
SHA256

91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67
SHA512

645594fc8e9823ca68e0cd70e60022b330c1b233a4e2938579b4ca7010bfa62d36e1300070d68f25c7af3c43c3e1742036ab6f81971880e239069bfe9e7e993e
SSDEEP

384:zslUlEvOEJ8xWwYJOMiOBZEdj1567gtwi5HhbQmRvR6JZlbw8hqIusZzZ0Hk:EeEvwIlLMRpcnuxE

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

43.249.38.36:5552

Mutex

1c214698f485e7d0799a81ebc3c171f7

Attributes

reg_key
1c214698f485e7d0799a81ebc3c171f7
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

1540 netsh.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

s.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Control Panel\International\Geo\Nation s.exe

pid	process
1540	netsh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Control Panel\International\Geo\Nation	s.exe

Drops startup file 2 IoCs

Processes:

spur.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c214698f485e7d0799a81ebc3c171f7.exe	spur.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c214698f485e7d0799a81ebc3c171f7.exe	spur.exe

Executes dropped EXE 1 IoCs

Processes:

spur.exe

pid process

900 spur.exe

pid	process
900	spur.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

spur.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1c214698f485e7d0799a81ebc3c171f7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\spur.exe\" .."	spur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1c214698f485e7d0799a81ebc3c171f7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\spur.exe\" .."	spur.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

spur.exe

description	pid	process
Token: SeDebugPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe
Token: 33	900	spur.exe
Token: SeIncBasePriorityPrivilege	900	spur.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

s.exespur.exe

description	pid	process	target process
PID 876 wrote to memory of 900	876	s.exe	spur.exe
PID 876 wrote to memory of 900	876	s.exe	spur.exe
PID 876 wrote to memory of 900	876	s.exe	spur.exe
PID 900 wrote to memory of 1540	900	spur.exe	netsh.exe
PID 900 wrote to memory of 1540	900	spur.exe	netsh.exe
PID 900 wrote to memory of 1540	900	spur.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\s.exe
"C:\Users\Admin\AppData\Local\Temp\s.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:876

C:\Users\Admin\AppData\Local\Temp\spur.exe
"C:\Users\Admin\AppData\Local\Temp\spur.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\spur.exe" "spur.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\spur.exe
Filesize
23KB

MD5
4d0542e1d74a6be9dae377b16ddacc17

SHA1
cb0e366897672385e2bcad2a8c98b038a8b6cd99

SHA256
91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67

SHA512
645594fc8e9823ca68e0cd70e60022b330c1b233a4e2938579b4ca7010bfa62d36e1300070d68f25c7af3c43c3e1742036ab6f81971880e239069bfe9e7e993e

Download Submit
C:\Users\Admin\AppData\Local\Temp\spur.exe
Filesize
23KB

MD5
4d0542e1d74a6be9dae377b16ddacc17

SHA1
cb0e366897672385e2bcad2a8c98b038a8b6cd99

SHA256
91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67

SHA512
645594fc8e9823ca68e0cd70e60022b330c1b233a4e2938579b4ca7010bfa62d36e1300070d68f25c7af3c43c3e1742036ab6f81971880e239069bfe9e7e993e

Download Submit
C:\Users\Admin\AppData\Local\Temp\spur.exe
Filesize
23KB

MD5
4d0542e1d74a6be9dae377b16ddacc17

SHA1
cb0e366897672385e2bcad2a8c98b038a8b6cd99

SHA256
91997affc537134c5dcef64236568d14974ae3f5b4e2e3cf2330a6c0a2cd8c67

SHA512
645594fc8e9823ca68e0cd70e60022b330c1b233a4e2938579b4ca7010bfa62d36e1300070d68f25c7af3c43c3e1742036ab6f81971880e239069bfe9e7e993e

Download Submit
memory/876-0-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/876-1-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Filesize
64KB

Download
memory/876-2-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/876-12-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/900-13-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/900-15-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/900-16-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads