Analysis

  • max time kernel
    1800s
  • max time network
    1809s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-02-2024 03:23

General

  • Target

    New Client.exe

  • Size

    188KB

  • MD5

    b848808a7c3f542eaf9718c0c8e0159f

  • SHA1

    c8fc1af2a0e6df1be9426b5f2e636b7f2b1aa302

  • SHA256

    13fde5c8aeb2fe2335dcb803a1a31a404e2f65e990d2a728a0df681ef832b616

  • SHA512

    0eb66a47448b588cdbd4b1b1d426c70b10fd073f2612a1f45e3abbec7b61f35735ff2a8cfeb1eb3f5390f89cc3abd88522a1c7ff20ddc8857242e8ce7335ac2d

  • SSDEEP

    3072:p2B+64kQ2EJam2dNREz9Vnc4OZMJwGu3U4QyZom8exsrPR5TE7D0XuDTTo6M//lz:p2B+64kQ2EJam2dNREz9FdOZMJwGuE42

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

AntiVirus

C2

127.0.0.1:38277

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 3 IoCs
  • Modifies Control Panel 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Client.exe
    "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4404
    • C:\Windows\SYSTEM32\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
    • C:\Windows\SYSTEM32\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2160
    • C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f im explorer.exe
      2⤵
      • Kills process with taskkill
      PID:4900
    • C:\Users\Admin\AppData\Local\Temp\157fa94688624d349c00db3c51c8581a.exe
      "C:\Users\Admin\AppData\Local\Temp\157fa94688624d349c00db3c51c8581a.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Modifies Control Panel
      PID:2828
    • C:\Users\Admin\AppData\Local\Temp\6a34055d7546487c979a4f66440271b7.exe
      "C:\Users\Admin\AppData\Local\Temp\6a34055d7546487c979a4f66440271b7.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4200
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\loll.VBS"
        3⤵
        • Enumerates connected drives
        PID:4560
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x248
    1⤵
      PID:824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

      Filesize

      9KB

      MD5

      7050d5ae8acfbe560fa11073fef8185d

      SHA1

      5bc38e77ff06785fe0aec5a345c4ccd15752560e

      SHA256

      cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

      SHA512

      a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

    • C:\Users\Admin\AppData\Local\Temp\157fa94688624d349c00db3c51c8581a.exe

      Filesize

      793KB

      MD5

      a83185ef7c03bfe0e0fbe10098876a34

      SHA1

      b166fed95e9bcc9f8b0ac4deafa9c45c21e91d0d

      SHA256

      7a923db27ae488a02e77242b1bbceb9a64898b9c2d085372a5ef5fca06b2a4be

      SHA512

      283e698b326d044480c49351531249ab9ed3a851c1d2c4a36c87fc5ecbaf2771af58f39cc0fc1551d08a4674ad766a3d4b96b6ee6ca1e6e967727f320f599f4c

    • C:\Users\Admin\AppData\Local\Temp\6a34055d7546487c979a4f66440271b7.exe

      Filesize

      396KB

      MD5

      a703c3b8a39537ce9be339bbc7339a45

      SHA1

      10354130b42e12c39eb6f3ce95b8368f581ef71b

      SHA256

      fce41ec4380d80f04eea4f2bb4ed9734c0ed31fb85c8897c0e299fbc0de41f60

      SHA512

      f73d2daaf572028655e4168834af7fb5477af4748f99845db314c57ab3a08c16d64bd2c5489f5c84ac3b0dcd16ec414284b5994091c3e44929fc7e923d26cb07

    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\loll.VBS

      Filesize

      168B

      MD5

      2b56784f8f16a689b305a1c768f28689

      SHA1

      e81ce025337ff3ebfc8bc48d43d360345a18688f

      SHA256

      dcd7fe09e32ec3a9fd356f12ded8e3f2ae520a99c8dc996b48dc98a39d68a077

      SHA512

      d0134e11bea5809b966cae3cc60828e557d6acddab890e56c0e22bed7c4facda582f77dd00a7ccb6da66200cc610ba9bd4423dcf33075f3b2b18434f219bbd68

    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\prj_13626871_c66985d209c8197ecce4f5ce7899b49d_1656581581.mp3

      Filesize

      83KB

      MD5

      4843241a72238329e13f2497733fd70c

      SHA1

      c6b6fcc361bbcf17e9d05868deec5700b9e1d048

      SHA256

      3c6de7e0e9b3781a9bbf710553efaacbd61afd486034a1a633e571fdb02f4348

      SHA512

      f302d7b69c6a9eced6770ca2e6da3119c3bdf9c2a6a90657814cf0b5ddc52f3c336a4c5e45152443bb6d6f3fa777e3d99c82a3c090c6fa5b4b377f5aa0e1ba20

    • C:\Users\Admin\AppData\Local\Temp\autDF6E.tmp

      Filesize

      138KB

      MD5

      7c30424c525cb64760083e066ca1f77d

      SHA1

      69c369028e3db4fe5c2fbc69cbd837d66496c480

      SHA256

      b75685e5fe51601632066ae2cb162738b340c9873f3b30cd4eb0b6f80cc27643

      SHA512

      59d726222ffc846ada2e7c6d040e0f0114e2cb92e72f81f23489aa6681b07a1c8cfceb7e81f9b7d7678d33b313302d9cf39c345d862e43f2768e145df14ef8df

    • memory/4404-12-0x00000000025A0000-0x00000000025A8000-memory.dmp

      Filesize

      32KB

    • memory/4404-5-0x000000001C370000-0x000000001C416000-memory.dmp

      Filesize

      664KB

    • memory/4404-13-0x000000001D180000-0x000000001D1E2000-memory.dmp

      Filesize

      392KB

    • memory/4404-14-0x000000001CF50000-0x000000001CF69000-memory.dmp

      Filesize

      100KB

    • memory/4404-15-0x00000000025F0000-0x0000000002600000-memory.dmp

      Filesize

      64KB

    • memory/4404-16-0x00007FFB15D70000-0x00007FFB16710000-memory.dmp

      Filesize

      9.6MB

    • memory/4404-17-0x00000000025F0000-0x0000000002600000-memory.dmp

      Filesize

      64KB

    • memory/4404-18-0x00007FFB15D70000-0x00007FFB16710000-memory.dmp

      Filesize

      9.6MB

    • memory/4404-19-0x00000000025F0000-0x0000000002600000-memory.dmp

      Filesize

      64KB

    • memory/4404-20-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

      Filesize

      40KB

    • memory/4404-11-0x000000001D070000-0x000000001D10C000-memory.dmp

      Filesize

      624KB

    • memory/4404-0-0x00007FFB15D70000-0x00007FFB16710000-memory.dmp

      Filesize

      9.6MB

    • memory/4404-4-0x000000001C130000-0x000000001C16A000-memory.dmp

      Filesize

      232KB

    • memory/4404-3-0x000000001B6F0000-0x000000001BBBE000-memory.dmp

      Filesize

      4.8MB

    • memory/4404-2-0x00007FFB15D70000-0x00007FFB16710000-memory.dmp

      Filesize

      9.6MB

    • memory/4404-1-0x00000000025F0000-0x0000000002600000-memory.dmp

      Filesize

      64KB

    • memory/4560-197-0x0000000007F60000-0x0000000007F70000-memory.dmp

      Filesize

      64KB

    • memory/4560-198-0x0000000007F60000-0x0000000007F70000-memory.dmp

      Filesize

      64KB

    • memory/4560-203-0x0000000007F60000-0x0000000007F70000-memory.dmp

      Filesize

      64KB

    • memory/4560-202-0x0000000007F60000-0x0000000007F70000-memory.dmp

      Filesize

      64KB

    • memory/4560-200-0x0000000007F60000-0x0000000007F70000-memory.dmp

      Filesize

      64KB

    • memory/4560-204-0x0000000007F60000-0x0000000007F70000-memory.dmp

      Filesize

      64KB

    • memory/4560-206-0x0000000007F60000-0x0000000007F70000-memory.dmp

      Filesize

      64KB

    • memory/4560-207-0x0000000007F60000-0x0000000007F70000-memory.dmp

      Filesize

      64KB