njrat | fbcabedebc3e2e5ebf0cc4023ac24c87a8ca8fc1bd818dd2e9e356de207bb04c

Resubmissions

05/02/2024, 03:51

240205-ee111sbgfm10

05/02/2024, 01:15

240205-bmdznshbfk10

Analysis

max time kernel
145s
max time network
138s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe
Size 189KB
Sample240205-bmdznshbfk
SHA256 f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79
MD5 3483079188b9a730fc255ac4d8c51f07
SHA1 f0ba23547b985524284b34993e6f650cf3fe48f7
SHA512 81b0e4ca7059ae7c08e26d105c3a7a5911f509723b43318e485828cce6bcfd663220a470dafe4085689707ee2dd86036bb4f9043b0d3b53c77b9dd7fd80ffa75
SSDEEP 3072:xBfsGpcW25Gp+VIVnZM0NLsqHjHVcid1gOoVHFxq2YEOnB+llUhckPDfG:LsGckEKnZbDHVPgRUEOB+YJPzG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat nyan cat persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

vinijr27.duckdns.org:3030

Mutex

a4729d8cd4374

Attributes

reg_key
a4729d8cd4374
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\UnitySetup = "C:\\Users\\Public\\UnityStub.exe"	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 2564	1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe
Token: 33	2564	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2564	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2564	1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe	28
PID 1924 wrote to memory of 2564	1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe	28
PID 1924 wrote to memory of 2564	1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe	28
PID 1924 wrote to memory of 2564	1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe	28
PID 1924 wrote to memory of 2564	1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe	28
PID 1924 wrote to memory of 2564	1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe	28
PID 1924 wrote to memory of 2564	1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe	28
PID 1924 wrote to memory of 2564	1924	f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe	28

C:\Users\Admin\AppData\Local\Temp\f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe
"C:\Users\Admin\AppData\Local\Temp\f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-1-0x0000000000970000-0x0000000000ACC000-memory.dmp

Download

memory/1924-3-0x0000000000130000-0x0000000000133000-memory.dmp

Download

memory/2564-4-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2564-6-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2564-8-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads