Analysis

  • max time kernel
    1807s
  • max time network
    1819s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-02-2024 03:23

General

  • Target

    New Client.exe

  • Size

    188KB

  • MD5

    b848808a7c3f542eaf9718c0c8e0159f

  • SHA1

    c8fc1af2a0e6df1be9426b5f2e636b7f2b1aa302

  • SHA256

    13fde5c8aeb2fe2335dcb803a1a31a404e2f65e990d2a728a0df681ef832b616

  • SHA512

    0eb66a47448b588cdbd4b1b1d426c70b10fd073f2612a1f45e3abbec7b61f35735ff2a8cfeb1eb3f5390f89cc3abd88522a1c7ff20ddc8857242e8ce7335ac2d

  • SSDEEP

    3072:p2B+64kQ2EJam2dNREz9Vnc4OZMJwGu3U4QyZom8exsrPR5TE7D0XuDTTo6M//lz:p2B+64kQ2EJam2dNREz9FdOZMJwGuE42

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

AntiVirus

C2

127.0.0.1:38277

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:15217

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Client.exe
    "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\system32\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2532
    • C:\Windows\system32\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2756
    • C:\Windows\system32\taskkill.exe
      taskkill /f im explorer.exe
      2⤵
      • Kills process with taskkill
      PID:2712
    • C:\Users\Admin\AppData\Local\Temp\d9e81b8cdbbb431fb34455d7c346bbb7.exe
      "C:\Users\Admin\AppData\Local\Temp\d9e81b8cdbbb431fb34455d7c346bbb7.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /F /IM wscript.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2960
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /F /IM cmd.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3056
    • C:\Users\Admin\AppData\Local\Temp\698415d7cec947128a715922130fd22d.exe
      "C:\Users\Admin\AppData\Local\Temp\698415d7cec947128a715922130fd22d.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /F /IM wscript.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1072
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /F /IM cmd.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3052
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1200
      2⤵
        PID:2900

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\d9e81b8cdbbb431fb34455d7c346bbb7.exe

      Filesize

      65KB

      MD5

      a85056ecfbf94af8efaa2e9dcec8ebb1

      SHA1

      f081275fbbdddad10689e185a750e1fd1ca0d0e5

      SHA256

      e00d04dcc4489101599f86df3956673c2ebcb8adbf05fb603266b91e9336b955

      SHA512

      c510e21e4d5b2b8fb2e7e902f74a6befbe20896490e607d640a2611020f20cede1d154e894fde5be8a6a2e564d2d7eb6d741d9b3ef21cdbefc5abdbc6a056fa9

    • memory/1620-29-0x0000000074510000-0x0000000074ABB000-memory.dmp

      Filesize

      5.7MB

    • memory/1620-20-0x0000000000C40000-0x0000000000C80000-memory.dmp

      Filesize

      256KB

    • memory/1620-19-0x0000000074510000-0x0000000074ABB000-memory.dmp

      Filesize

      5.7MB

    • memory/1620-32-0x0000000074510000-0x0000000074ABB000-memory.dmp

      Filesize

      5.7MB

    • memory/1620-21-0x0000000074510000-0x0000000074ABB000-memory.dmp

      Filesize

      5.7MB

    • memory/1620-31-0x0000000074510000-0x0000000074ABB000-memory.dmp

      Filesize

      5.7MB

    • memory/1620-30-0x0000000000C40000-0x0000000000C80000-memory.dmp

      Filesize

      256KB

    • memory/2504-28-0x0000000074510000-0x0000000074ABB000-memory.dmp

      Filesize

      5.7MB

    • memory/2504-46-0x0000000074510000-0x0000000074ABB000-memory.dmp

      Filesize

      5.7MB

    • memory/2504-33-0x0000000074510000-0x0000000074ABB000-memory.dmp

      Filesize

      5.7MB

    • memory/2900-34-0x0000000001E20000-0x0000000001E21000-memory.dmp

      Filesize

      4KB

    • memory/2900-47-0x0000000001E20000-0x0000000001E21000-memory.dmp

      Filesize

      4KB

    • memory/3008-10-0x00000000001E0000-0x0000000000260000-memory.dmp

      Filesize

      512KB

    • memory/3008-12-0x00000000001E0000-0x0000000000260000-memory.dmp

      Filesize

      512KB

    • memory/3008-0-0x0000000001E50000-0x0000000001E8A000-memory.dmp

      Filesize

      232KB

    • memory/3008-3-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp

      Filesize

      9.6MB

    • memory/3008-1-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp

      Filesize

      9.6MB

    • memory/3008-11-0x0000000000570000-0x000000000057A000-memory.dmp

      Filesize

      40KB

    • memory/3008-2-0x00000000001E0000-0x0000000000260000-memory.dmp

      Filesize

      512KB

    • memory/3008-9-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp

      Filesize

      9.6MB

    • memory/3008-8-0x00000000001E0000-0x0000000000260000-memory.dmp

      Filesize

      512KB

    • memory/3008-7-0x000007FEF4810000-0x000007FEF51AD000-memory.dmp

      Filesize

      9.6MB