njrat | aca777666d3337112af776a4541fa1b8366546e3078f857ffd41e91f40241f7d

Analysis

max time kernel
146s
max time network
141s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
79DBDF892CAE743DEC344055BFDE6D68.exe
Size 112KB
Sample240409-b339haea41
SHA256 aca777666d3337112af776a4541fa1b8366546e3078f857ffd41e91f40241f7d
MD5 79dbdf892cae743dec344055bfde6d68
SHA1 0cc36ec9d2b26b436ec9fc2245770e7ae575f065
SHA512 523855b9e9dc0f1b914e0bd838923f8113b291f4ff27782ef7c3834d5a717574403ce3c4ae8e2d0a3fa688ed3984ab5add1ba534967163187b5046a5dd35e03f
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMb:P5eznsjsguGDFqGZ2rb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2448	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2860	chargeable.exe
2624	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
2700	79DBDF892CAE743DEC344055BFDE6D68.exe
2700	79DBDF892CAE743DEC344055BFDE6D68.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	79DBDF892CAE743DEC344055BFDE6D68.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\79DBDF892CAE743DEC344055BFDE6D68.exe"	79DBDF892CAE743DEC344055BFDE6D68.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2624	2860	chargeable.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe
Token: 33	2624	chargeable.exe
Token: SeIncBasePriorityPrivilege	2624	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2860	2700	79DBDF892CAE743DEC344055BFDE6D68.exe	28
PID 2700 wrote to memory of 2860	2700	79DBDF892CAE743DEC344055BFDE6D68.exe	28
PID 2700 wrote to memory of 2860	2700	79DBDF892CAE743DEC344055BFDE6D68.exe	28
PID 2700 wrote to memory of 2860	2700	79DBDF892CAE743DEC344055BFDE6D68.exe	28
PID 2860 wrote to memory of 2624	2860	chargeable.exe	29
PID 2860 wrote to memory of 2624	2860	chargeable.exe	29
PID 2860 wrote to memory of 2624	2860	chargeable.exe	29
PID 2860 wrote to memory of 2624	2860	chargeable.exe	29
PID 2860 wrote to memory of 2624	2860	chargeable.exe	29
PID 2860 wrote to memory of 2624	2860	chargeable.exe	29
PID 2860 wrote to memory of 2624	2860	chargeable.exe	29
PID 2860 wrote to memory of 2624	2860	chargeable.exe	29
PID 2860 wrote to memory of 2624	2860	chargeable.exe	29
PID 2624 wrote to memory of 2448	2624	chargeable.exe	30
PID 2624 wrote to memory of 2448	2624	chargeable.exe	30
PID 2624 wrote to memory of 2448	2624	chargeable.exe	30
PID 2624 wrote to memory of 2448	2624	chargeable.exe	30

C:\Users\Admin\AppData\Local\Temp\79DBDF892CAE743DEC344055BFDE6D68.exe
"C:\Users\Admin\AppData\Local\Temp\79DBDF892CAE743DEC344055BFDE6D68.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

C0018BB1B5834735BFA60CD063B31956

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956
Size 1KB
SHA256 1e377d5df77b88b5dd8cde349ceb5c939eaddb2af2676ec91346f9ef7e24a0ab
MD5 0376ba21bc7c1d09e61b206c11bbc92c
SHA1 443fee1cb47f3497f1e8042a94c5da8655aa7cd7
SHA512 f68db4ce81924b2531b3467a23e02b2913086b6293d0d5a81fe9dbee941504502ea590d4667e3e758f3b4986384200700cb919bc7a5b75a29080e66b29aa9e23
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 5c048ae4518a5941e8a997c80d6aec8852d97ec03c1439b6b0ea37d43a025dcf
MD5 24bbf808c27e9597b7f67c51747548bb
SHA1 14bd8963eee27fb9a76209eabacac6d02910f932
SHA512 5c5bc7d72e53c9c7b7fabd51e57031cb89b7fe615e83efd16c0052ded2eb6d827ced05c8716096e22e2798f3adc30dd70f298ba98f172c7500926ba707885d91
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 82e35baecec57a79654cacea22fd4b088aec30163b98db6ac03e17bc02824bbd
MD5 9280e115bcefe3f129ad1b865d2940fb
SHA1 1b061f5b9e077dea6a0db8d6e9e062b25ff0cfc9
SHA512 9fc39cb03a321aeeb5a0c11d3f64cf1b21cd0ec36dcfe31ab76207481e076c013c37c740503200d6992c8f8f47496e2de2ed6f732d89abb5e04e2e4e864ce434
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 5d82330364c376e2fc037e9c8f2ed4fd0a45fcd1eb532f13221bcb0fe03f79c5
MD5 3f783040cad0b5601cc7382aeb100ec5
SHA1 d66cb470bdd4abe064df46d1bb5eae1e820606ef
SHA512 10f549cc3480aba972e564c0bb1a19263fce09b9d2f6ae7fc718f99e8056baa5b2b36ad938b0e199a20994f8a4c0d83346311c8de6566c9578926ccf2d37f153
MD5 SHA1 SHA512

Submit Download

C0018BB1B5834735BFA60CD063B31956

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956
Size 252B
SHA256 8c1598486c88ba5ac6659899da07c4e885b76d9e930855dda2f1ab0adf495994
MD5 9e3a7955c46c17d5b71f80670ac95126
SHA1 652a3875b00b268c2f476cf6f618db8a0db0c2de
SHA512 29e8ed717a9b15e91350064dcae87901f44049ddda5105c13182fc439b4eb7ec484875abbd89ed8358a94c7bb2ea9a8365ef3e6487a1d51cd9004db20970e92f
MD5 SHA1 SHA512

Submit Download

Cab2676.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab2676.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar2689.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar2689.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar28B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar28B5.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

chargeable.exe

Path \Users\Admin\AppData\Roaming\confuse\chargeable.exe
Size 112KB
SHA256 bbb32bfc4277ed5d9e79e6416003b85678fff2f0aa3a2201a54e7fd87f2b11ff
MD5 b86c74ddb2959213a46abd43717cac5f
SHA1 18528c45f8d743d363d496ceaef233745d116c5a
SHA512 d8a2cbe5537beb8ae0bf24a58d7275a69578086f1b76911865a3a6e0ba81ba387bbe34f33626f1b3af2f0e61aaca3b674012889f62d78c9d78973b08def14e12
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMp:P5eznsjsguGDFqGZ2rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2624-370-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2624-373-0x0000000074600000-0x0000000074BAB000-memory.dmp

Download

memory/2624-376-0x0000000000100000-0x0000000000140000-memory.dmp

Download

memory/2624-375-0x0000000074600000-0x0000000074BAB000-memory.dmp

Download

memory/2624-374-0x0000000000100000-0x0000000000140000-memory.dmp

Download

memory/2624-372-0x0000000074600000-0x0000000074BAB000-memory.dmp

Download

memory/2624-365-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2624-368-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2700-1-0x0000000074600000-0x0000000074BAB000-memory.dmp

Download

memory/2700-2-0x0000000000200000-0x0000000000240000-memory.dmp

Download

memory/2700-0-0x0000000074600000-0x0000000074BAB000-memory.dmp

Download

memory/2700-204-0x0000000074600000-0x0000000074BAB000-memory.dmp

Download

memory/2860-364-0x0000000000C60000-0x0000000000CA0000-memory.dmp

Download

memory/2860-371-0x0000000074600000-0x0000000074BAB000-memory.dmp

Download

memory/2860-194-0x0000000074600000-0x0000000074BAB000-memory.dmp

Download

memory/2860-205-0x0000000000C60000-0x0000000000CA0000-memory.dmp

Download

memory/2860-213-0x0000000074600000-0x0000000074BAB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads