njrat | db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b

Analysis

max time kernel
149s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe
Size 620KB
Sample240126-mm3htabfa7
SHA256 db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b
MD5 9722988f8586fbe48e1cfb5be278de76
SHA1 c88d975dd5df83ecb8f4dd29da261335726378a4
SHA512 ffc1dbf49fcda55ba4ea99b5e6ed3147ceb11b6a6e0c720a3eef30b023ecbf4348b247e1ddb0893392bfdfdcd8b00b25308c7a300e8207c059a785de4c854bc2
SSDEEP 12288:nBdlwHRn+WlYV+1MOzh01OvYhTIanY/6mn8MOUfXKPC:nBkVdlYAthZY1zm8MxfuC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat png persistence trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

127.0.0.1:7777

Mutex

png.exe

Attributes

reg_key
png.exe
splitter
|Ghost|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\png.exe	png.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\png.url	png.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\png.exe	png.exe

Executes dropped EXE 2 IoCs

pid	Process
2592	png.exe
308	png.exe

Loads dropped DLL 4 IoCs

pid	Process
2356	db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe
2356	db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe
2356	db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe
2592	png.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\png.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\png.exe\" .."	png.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\png.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\png.exe\" .."	png.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com
11	7.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe
Token: 33	308	png.exe
Token: SeIncBasePriorityPrivilege	308	png.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	DllHost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2592	2356	db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe	29
PID 2356 wrote to memory of 2592	2356	db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe	29
PID 2356 wrote to memory of 2592	2356	db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe	29
PID 2356 wrote to memory of 2592	2356	db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe	29
PID 2592 wrote to memory of 308	2592	png.exe	30
PID 2592 wrote to memory of 308	2592	png.exe	30
PID 2592 wrote to memory of 308	2592	png.exe	30
PID 2592 wrote to memory of 308	2592	png.exe	30

C:\Users\Admin\AppData\Local\Temp\db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe
"C:\Users\Admin\AppData\Local\Temp\db632c945b6a032e8d731e05859041965696bab877af546c13e5a7c7d06b0d9b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\png.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\png.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Roaming\png.exe
    "C:\Users\Admin\AppData\Roaming\png.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:308

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

16968319706500.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\16968319706500.jpg
Size 96KB
SHA256 fe5a474b0554933a2a44d4267e06c665a0a9ddeeae7d7548d4c595ed9f408719
MD5 8772ded777c272077008105fc433cd8f
SHA1 527f1b2375d8c6d445a14e9c758ca627ed0aa08a
SHA512 ba2ae6f5a75e5d3632254e610628ab0a64cc25cd03986a10c050922debb91e87131461df8bb5de211917dd8f1994c218e70e22351ab0277f3f441200869e1a4f
SSDEEP 1536:QwxotDoqdM6s5J3SdHxvOpqwMHxlQOOVp6D672SNCyxI5lT2SBual/:PoNP2r5QRFHvQOO3W6SShxI7aS8a/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar6260.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar6260.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

png.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX0\png.exe
Size 68KB
SHA256 cdc0807e6948e76bbcb23c74aae548d60466a7edeb5408cfdd8be51352a29c3b
MD5 fc92426b5b4ec4dc2029106efb293843
SHA1 a7a6c9e1e9d375bf54f1add65c83f05f1579cca8
SHA512 8ac52345ba34a43bc96269dbf7807c0ac3497f67d845a35f25fe849d6e1a2c12c2127f0ee467183ab3b749efff13cbb1876bc381f76e8f1190834f46d8468398
SSDEEP 1536:HrjTWAoN36t0QviFw1HXiIBnvbVfLteF3nLrB9z3nUaF9bnwS9vM:HrjT7oN36t0QviFC3LBnBfWl9zkaF9b4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/308-32-0x0000000000810000-0x0000000000826000-memory.dmp

Download

memory/308-31-0x0000000073B20000-0x000000007420E000-memory.dmp

Download

memory/308-37-0x00000000007C0000-0x0000000000800000-memory.dmp

Download

memory/308-75-0x0000000073B20000-0x000000007420E000-memory.dmp

Download

memory/308-76-0x00000000007C0000-0x0000000000800000-memory.dmp

Download

memory/308-77-0x0000000001E70000-0x0000000001E7A000-memory.dmp

Download

memory/2228-38-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/2228-6-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/2228-5-0x0000000000140000-0x0000000000142000-memory.dmp

Download

memory/2356-4-0x0000000002220000-0x0000000002222000-memory.dmp

Download

memory/2592-20-0x0000000073B20000-0x000000007420E000-memory.dmp

Download

memory/2592-19-0x0000000000F80000-0x0000000000F96000-memory.dmp

Download

memory/2592-33-0x0000000073B20000-0x000000007420E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads