njrat | d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe
Size 31KB
Sample240125-ghlfvaaael
SHA256 d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9
MD5 a5ad2d1796744144d739569bb466b307
SHA1 42de0164c8cbd9b6c64100de720d2e0c49ebcb77
SHA512 45fa09478a871a75f4650a56529632bfddf93990819c6d5212753325305a7946c631076897b13e62297136ae26db064fef701dea23453ea504b4c2517d5e74b9
SSDEEP 384:c8LBBi/W/7mgEp87wYK2GePqZhbM2AQk93vmhm7UMKmIEecKdbXTzm9bVhcaO6fd:5W/sqoHT2A/vMHTi9bD/Qz1n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

172.20.6.206:1992

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe

Executes dropped EXE 1 IoCs

pid	Process
4248	Payload.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe"	d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe
Token: 33	4248	Payload.exe
Token: SeIncBasePriorityPrivilege	4248	Payload.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4248	4324	d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe	96
PID 4324 wrote to memory of 4248	4324	d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe	96
PID 4324 wrote to memory of 4248	4324	d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe	96
PID 4324 wrote to memory of 3216	4324	d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe	97
PID 4324 wrote to memory of 3216	4324	d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe	97
PID 4324 wrote to memory of 3216	4324	d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe	97

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3216	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe
"C:\Users\Admin\AppData\Local\Temp\d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\Payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - Views/modifies file attributes
  PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Payload.exe

Path C:\Users\Admin\AppData\Local\Temp\Payload.exe
Size 31KB
SHA256 d5c62e521f44e5fc7bc80dd61a163e86405eae49dbbc9101aad6b6261b79abf9
MD5 a5ad2d1796744144d739569bb466b307
SHA1 42de0164c8cbd9b6c64100de720d2e0c49ebcb77
SHA512 45fa09478a871a75f4650a56529632bfddf93990819c6d5212753325305a7946c631076897b13e62297136ae26db064fef701dea23453ea504b4c2517d5e74b9
SSDEEP 384:c8LBBi/W/7mgEp87wYK2GePqZhbM2AQk93vmhm7UMKmIEecKdbXTzm9bVhcaO6fd:5W/sqoHT2A/vMHTi9bD/Qz1n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
Size 1KB
SHA256 e1808a9ec0523300a4595516b0b3ed5c4864a793af53e1029916016160e5491b
MD5 31653ca36cd68461cfca21215673301d
SHA1 abf9ec7599a9667cbfd1e6d608e582d42651dbc1
SHA512 f6638339eb1aabbd0e7302d00e56d864f5e0588fcec09ba8cdd9324f5b4b97c921904282593fd31571c4f12b843e3ef6220d6c4d1acd2d3899626d8d5fbde71f
MD5 SHA1 SHA512

Submit Download

Windows.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
Size 1KB
SHA256 adc51866f58a29f1b28041f934f9e7cf217cce3b197f88020e6cdbcfdf16f6b2
MD5 8c8dfa9b23188a1e043ace4857fb7386
SHA1 4a6534d71517b8b5cc99e3eca1d840ee1f62f644
SHA512 7ee268188333e9aeacaeae32f2f0f1831087c3220fd4f509a836a896ae5c64a6cb247578cd96f7d3a65dd75fbb7026a861b3acad85b7350d146a4d8539c329a2
MD5 SHA1 SHA512

Submit Download

memory/4248-15-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/4248-16-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4248-17-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/4248-23-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/4324-0-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/4324-1-0x00000000010D0000-0x00000000010E0000-memory.dmp

Download

memory/4324-2-0x0000000075260000-0x0000000075811000-memory.dmp

Download

memory/4324-14-0x0000000075260000-0x0000000075811000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads