njrat | b1c0e35f47273a236518f43ee56c0367d8b423ca9ed8f9e7ad4a875caa47bb69

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
753c707e47bce65d32be781ea1584e0b.exe
Size 84KB
Sample240125-xd2v2adad5
SHA256 b1c0e35f47273a236518f43ee56c0367d8b423ca9ed8f9e7ad4a875caa47bb69
MD5 753c707e47bce65d32be781ea1584e0b
SHA1 7b43f6a910b01553dfae51560570365e3ce9ed42
SHA512 8afc2ebbc80e17e42317202e9479e0c223456cf9f0b22ccdf9fe486eff19ebf9a33a2e00c01aa81168d4ad9950c34c8d78dc2f5821702fe61874221088d3cdda
SSDEEP 1536:2ppfa5dJy8Cgrw7rPNDwhucaDlZ5gb0HI//4gQF0eCaL:3yIwmhuDlZWbcO4/waL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat nyan cat persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

NYAN CAT

narotomagic.publicvm.com:6663

Mutex

a728eeadc9774101a351e2a5b3fe9598

Attributes

reg_key
a728eeadc9774101a351e2a5b3fe9598
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	753c707e47bce65d32be781ea1584e0b.exe

Executes dropped EXE 2 IoCs

pid	Process
3428	primt.exe
4464	primt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\primt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\primt.exe\""	753c707e47bce65d32be781ea1584e0b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2528 set thread context of 628	2528	753c707e47bce65d32be781ea1584e0b.exe	55
PID 3428 set thread context of 4464	3428	primt.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	753c707e47bce65d32be781ea1584e0b.exe
Token: SeDebugPrivilege	3428	primt.exe
Token: SeDebugPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe
Token: 33	4464	primt.exe
Token: SeIncBasePriorityPrivilege	4464	primt.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 628	2528	753c707e47bce65d32be781ea1584e0b.exe	55
PID 2528 wrote to memory of 628	2528	753c707e47bce65d32be781ea1584e0b.exe	55
PID 2528 wrote to memory of 628	2528	753c707e47bce65d32be781ea1584e0b.exe	55
PID 2528 wrote to memory of 628	2528	753c707e47bce65d32be781ea1584e0b.exe	55
PID 2528 wrote to memory of 628	2528	753c707e47bce65d32be781ea1584e0b.exe	55
PID 2528 wrote to memory of 628	2528	753c707e47bce65d32be781ea1584e0b.exe	55
PID 2528 wrote to memory of 628	2528	753c707e47bce65d32be781ea1584e0b.exe	55
PID 2528 wrote to memory of 628	2528	753c707e47bce65d32be781ea1584e0b.exe	55
PID 628 wrote to memory of 3428	628	753c707e47bce65d32be781ea1584e0b.exe	98
PID 628 wrote to memory of 3428	628	753c707e47bce65d32be781ea1584e0b.exe	98
PID 628 wrote to memory of 3428	628	753c707e47bce65d32be781ea1584e0b.exe	98
PID 3428 wrote to memory of 4464	3428	primt.exe	99
PID 3428 wrote to memory of 4464	3428	primt.exe	99
PID 3428 wrote to memory of 4464	3428	primt.exe	99
PID 3428 wrote to memory of 4464	3428	primt.exe	99
PID 3428 wrote to memory of 4464	3428	primt.exe	99
PID 3428 wrote to memory of 4464	3428	primt.exe	99
PID 3428 wrote to memory of 4464	3428	primt.exe	99
PID 3428 wrote to memory of 4464	3428	primt.exe	99

C:\Users\Admin\AppData\Local\Temp\753c707e47bce65d32be781ea1584e0b.exe
"C:\Users\Admin\AppData\Local\Temp\753c707e47bce65d32be781ea1584e0b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\753c707e47bce65d32be781ea1584e0b.exe
  C:\Users\Admin\AppData\Local\Temp\753c707e47bce65d32be781ea1584e0b.exe
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Users\Admin\AppData\Roaming\primt.exe
    "C:\Users\Admin\AppData\Roaming\primt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Users\Admin\AppData\Roaming\primt.exe
      C:\Users\Admin\AppData\Roaming\primt.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

753c707e47bce65d32be781ea1584e0b.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\753c707e47bce65d32be781ea1584e0b.exe.log
Size 224B
SHA256 42f723d18283fda6a0904046cc29ee8d10e562d20c7615259a46ae9c0e4c9708
MD5 9c4b66f77f12558c48b620ddfb44029d
SHA1 446651db643b943ec37b9b3599655e211a4bc73e
SHA512 983aed0ec15a79b716ac6dc080146e4ed098c117c31167053fb5971649dc621d1db5292fdd76f3010f094b75d57ea0bdb35bc829c6ba37e4d276b266361dee8e
MD5 SHA1 SHA512

Submit Download

primt.exe

Path C:\Users\Admin\AppData\Roaming\primt.exe
Size 218KB
SHA256 2113654c27bcc782feff29471473cc287b1e6b1f39ad4935568625043576f11e
MD5 039a5b51fc7e4631371bd0a9f7d46552
SHA1 ac24b35d6fcf57c43434550318514f5652782001
SHA512 660b6bb4c6c13c7fd497cd9ecea424053568c8de60f4166f7799d5079f670e442b5d3ae871541a1e593c818be089168fc644681535a6c294557c371610bd4e56
SSDEEP 6144:3yIwmsSbn4/Sqy3AiPkgzD8lq+FVTW9itnM58:IzSbnjJfkgzgs+FJn88
MD5 SHA1 SHA512 SSDEEP

Submit Download

primt.exe

Path C:\Users\Admin\AppData\Roaming\primt.exe
Size 30KB
SHA256 9995bc27a7ce03ad4ac2af2a1456c0474c118fbab663991c69110d908ed29bf3
MD5 c0cbe513d52726eeef70a424251bc632
SHA1 4eb7048edf03e8967c66c68c9485362f864d7f40
SHA512 60fa894a25aed18715e0aa304fd1a8bee0bd4bbea38006578c15984549785310b30f8cc246c215570f4ff1bd85b71fc55699ef7c8cc8994eda0375a574c086d7
SSDEEP 768:ItNppfdHk5dJDGDB3xYPXAt03rn7O+JezXX:2ppfa5dJy8Cgrw7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

primt.exe

Path C:\Users\Admin\AppData\Roaming\primt.exe
Size 29KB
SHA256 ed06c4656842a2be02ed90a7df47660f2167e8d38e15219c668dedd3cb5fd2d2
MD5 124938b08469b59613e0d255adca9aac
SHA1 3cedde7927d726a9434bb07ddf6789be1441c54f
SHA512 e38df023c984c55497a91d54d3bb952eb783159d17dba08906e43dab6056e5d006fcb06476293fa23df194077af04387993063019af00dbe9828b68262b9ceba
SSDEEP 384:I9LFlZyvuZkF4fjc1CyISftTtndnJDGUS9JkZqSvDS3w6rg0PnYP/0GFOraevle1:ItNppfdHk5dJDGDB3xYPXAt03rn7O+JH
MD5 SHA1 SHA512 SSDEEP

Submit Download

primt.exe

Path C:\Users\Admin\AppData\Roaming\primt.exe
Size 712KB
SHA256 4d067430db404c961eecfb9c715726b3554f4ddb7acd48f9359fb9f5ea23a2fe
MD5 e6ec6168c4022ff1456d2be051716318
SHA1 e0c2b81ab6c3ad9d07a266b441fffdf8b041bc44
SHA512 eaceca9a417505dc653af545c06841d2e3d866d233bdd660a71e52a7a7ed06bc8527cb15bd0353e1e626723d771ac68ae8ee7ed9b0d04ed01084acf378de0262
SSDEEP 12288:IzSbnjJfkgzgs+FJn8cCyX4YVmEEunknsA63zPP/BkusSICK5N4Dopw8LueE:IORzEs+H8pQVmkknsTzPhkudK5N4Dcwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-3-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/628-9-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/628-7-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/628-8-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

Download

memory/628-21-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/2528-6-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/2528-1-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

Download

memory/2528-2-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/2528-0-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/3428-23-0x00000000018F0000-0x0000000001900000-memory.dmp

Download

memory/3428-28-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/3428-22-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/4464-30-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/4464-29-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/4464-31-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads