njrat | c4a303a933d34ae05da9b5208a1b523a4e0a53c40d648457b124338b8cede1ff

General

Target

7ece92212c59df419305a7915b0deb40.exe
Size

148KB
MD5

7ece92212c59df419305a7915b0deb40
SHA1

d39d2595dc53bec55ac4fa6262feb5ceb1e8637e
SHA256

c4a303a933d34ae05da9b5208a1b523a4e0a53c40d648457b124338b8cede1ff
SHA512

66ddb7692d0921b70f7cde29f0a7dc5d35f7bd8c0e78c97b9fe583e9a8379fd4915cdd746c868fa19ac8476ec7c6f137835c141523412810580077e99e6a8079
SSDEEP

3072:mR99ArBvfOBSdThazVJXdQ5/AdaAEUJ7XlE3pYLSxwp3Sb8:ocB1d9iXeSU87XlE+OxwpCb

Score

10^/10

njrat 4 evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

4

C2

rlawlsl154.codns.com:443

Mutex

a695e871b7f2f081334e678e67df6a28

Attributes

reg_key
a695e871b7f2f081334e678e67df6a28
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2028 netsh.exe

pid	process
2028	netsh.exe

Drops startup file 2 IoCs

Processes:

7ece92212c59df419305a7915b0deb40.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a695e871b7f2f081334e678e67df6a28.exe	7ece92212c59df419305a7915b0deb40.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a695e871b7f2f081334e678e67df6a28.exe	7ece92212c59df419305a7915b0deb40.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7ece92212c59df419305a7915b0deb40.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\a695e871b7f2f081334e678e67df6a28 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7ece92212c59df419305a7915b0deb40.exe\" .."	7ece92212c59df419305a7915b0deb40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\a695e871b7f2f081334e678e67df6a28 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7ece92212c59df419305a7915b0deb40.exe\" .."	7ece92212c59df419305a7915b0deb40.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

7ece92212c59df419305a7915b0deb40.exe

description	ioc	process
File created	D:\autorun.inf	7ece92212c59df419305a7915b0deb40.exe
File created	F:\autorun.inf	7ece92212c59df419305a7915b0deb40.exe
File opened for modification	F:\autorun.inf	7ece92212c59df419305a7915b0deb40.exe
File created	C:\autorun.inf	7ece92212c59df419305a7915b0deb40.exe
File opened for modification	C:\autorun.inf	7ece92212c59df419305a7915b0deb40.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7ece92212c59df419305a7915b0deb40.exe

pid	process
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe
3068	7ece92212c59df419305a7915b0deb40.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7ece92212c59df419305a7915b0deb40.exe

pid process

3068 7ece92212c59df419305a7915b0deb40.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

7ece92212c59df419305a7915b0deb40.exe

description	pid	process
Token: SeDebugPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe
Token: 33	3068	7ece92212c59df419305a7915b0deb40.exe
Token: SeIncBasePriorityPrivilege	3068	7ece92212c59df419305a7915b0deb40.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7ece92212c59df419305a7915b0deb40.exe

description	pid	process	target process
PID 3068 wrote to memory of 2028	3068	7ece92212c59df419305a7915b0deb40.exe	netsh.exe
PID 3068 wrote to memory of 2028	3068	7ece92212c59df419305a7915b0deb40.exe	netsh.exe
PID 3068 wrote to memory of 2028	3068	7ece92212c59df419305a7915b0deb40.exe	netsh.exe
PID 3068 wrote to memory of 2028	3068	7ece92212c59df419305a7915b0deb40.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\7ece92212c59df419305a7915b0deb40.exe
"C:\Users\Admin\AppData\Local\Temp\7ece92212c59df419305a7915b0deb40.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\7ece92212c59df419305a7915b0deb40.exe" "7ece92212c59df419305a7915b0deb40.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F:\svchost.exe

Filesize
148KB

MD5
7ece92212c59df419305a7915b0deb40

SHA1
d39d2595dc53bec55ac4fa6262feb5ceb1e8637e

SHA256
c4a303a933d34ae05da9b5208a1b523a4e0a53c40d648457b124338b8cede1ff

SHA512
66ddb7692d0921b70f7cde29f0a7dc5d35f7bd8c0e78c97b9fe583e9a8379fd4915cdd746c868fa19ac8476ec7c6f137835c141523412810580077e99e6a8079

Download Submit
memory/3068-0-0x0000000000930000-0x000000000095E000-memory.dmp

Filesize
184KB

Download
memory/3068-1-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/3068-2-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/3068-12-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/3068-13-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/3068-14-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads