Overview
overview
10Static
static
10RAT/Adwind.jar
windows7-x64
1RAT/Adwind.jar
windows10-2004-x64
10RAT/Blackkomet.exe
windows7-x64
10RAT/Blackkomet.exe
windows10-2004-x64
10RAT/CobaltStrike.docm
windows7-x64
10RAT/CobaltStrike.docm
windows10-2004-x64
10RAT/CrimsonRAT.exe
windows7-x64
10RAT/CrimsonRAT.exe
windows10-2004-x64
10RAT/NJRat.exe
windows7-x64
10RAT/NJRat.exe
windows10-2004-x64
10RAT/NetWire.doc
windows7-x64
10RAT/NetWire.doc
windows10-2004-x64
7RAT/NetWire.exe
windows7-x64
10RAT/NetWire.exe
windows10-2004-x64
10RAT/Remcos.exe
windows7-x64
10RAT/Remcos.exe
windows10-2004-x64
10RAT/RevengeRAT.exe
windows7-x64
10RAT/RevengeRAT.exe
windows10-2004-x64
10RAT/VanToM-Rat.exe
windows7-x64
7RAT/VanToM-Rat.exe
windows10-2004-x64
7RAT/WarzoneRAT.exe
windows7-x64
10RAT/WarzoneRAT.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-03-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
RAT/Adwind.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RAT/Adwind.jar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
RAT/Blackkomet.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
RAT/Blackkomet.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
RAT/CobaltStrike.docm
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
RAT/CobaltStrike.docm
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
RAT/CrimsonRAT.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
RAT/CrimsonRAT.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
RAT/NJRat.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
RAT/NJRat.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
RAT/NetWire.doc
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
RAT/NetWire.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
RAT/NetWire.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
RAT/NetWire.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
RAT/Remcos.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
RAT/Remcos.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
RAT/RevengeRAT.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
RAT/RevengeRAT.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
RAT/VanToM-Rat.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
RAT/VanToM-Rat.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
RAT/WarzoneRAT.exe
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
RAT/WarzoneRAT.exe
Resource
win10v2004-20240226-en
General
-
Target
RAT/NJRat.exe
-
Size
31KB
-
MD5
29a37b6532a7acefa7580b826f23f6dd
-
SHA1
a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
-
SHA256
7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
-
SHA512
a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818
-
SSDEEP
768:64+64ZRzo+zxJ+lS7gqzZ5XvzpQmIDUu0ti69j:xM3/Bh1QVkvj
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2384 netsh.exe -
Drops startup file 2 IoCs
Processes:
NJRat.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe NJRat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe NJRat.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
NJRat.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RAT\\NJRat.exe\" .." NJRat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RAT\\NJRat.exe\" .." NJRat.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
NJRat.exepid process 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe 4160 NJRat.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
NJRat.exedescription pid process Token: SeDebugPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe Token: 33 4160 NJRat.exe Token: SeIncBasePriorityPrivilege 4160 NJRat.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
NJRat.exedescription pid process target process PID 4160 wrote to memory of 2384 4160 NJRat.exe netsh.exe PID 4160 wrote to memory of 2384 4160 NJRat.exe netsh.exe PID 4160 wrote to memory of 2384 4160 NJRat.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RAT\NJRat.exe"C:\Users\Admin\AppData\Local\Temp\RAT\NJRat.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\RAT\NJRat.exe" "NJRat.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:2384
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1