njrat | 0837d32cd4aabde333efdfc2695f522c07e505131b3d36cc12618be91a057290

General

Target

Server.exe
Size

37KB
MD5

de43783b8b13388eb629c7675983def1
SHA1

9d8285f25c0e8d2a16fae6cba5d5dfbcf2c1d1f7
SHA256

0837d32cd4aabde333efdfc2695f522c07e505131b3d36cc12618be91a057290
SHA512

1052d7f2a2efb7543b970278f11e0b71410386fb7f8b1322ec14ec5681caf114e4f5ef2e30e1d3975207406559595a51d0e3c496de35a9bef6a3b58a6ca32a43
SSDEEP

384:SgzZxj6ic7ri5Z7JAyk/Y4IvDfZeKQVerAF+rMRTyN/0L+EcoinblneHQM3epzXl:RznHJ7k/Y4IDZbQorM+rMRa8NuTht

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

require-spa.gl.at.ply.gg:29750

Mutex

22a96a36e708412bc80ea4f11f20f4c1

Attributes

reg_key
22a96a36e708412bc80ea4f11f20f4c1
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

2692 netsh.exe
2036 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

3008 server.exe
Loads dropped DLL 1 IoCs

Processes:

Server.exe

pid process

2088 Server.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1844 PING.EXE

pid	process
2692	netsh.exe
2036	netsh.exe

pid	process
3008	server.exe

pid	process
2088	Server.exe

pid	process
1844	PING.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	3008	server.exe
Token: 33	3008	server.exe
Token: SeIncBasePriorityPrivilege	3008	server.exe
Token: 33	3008	server.exe
Token: SeIncBasePriorityPrivilege	3008	server.exe
Token: 33	3008	server.exe
Token: SeIncBasePriorityPrivilege	3008	server.exe
Token: 33	3008	server.exe
Token: SeIncBasePriorityPrivilege	3008	server.exe
Token: 33	3008	server.exe
Token: SeIncBasePriorityPrivilege	3008	server.exe
Token: 33	3008	server.exe
Token: SeIncBasePriorityPrivilege	3008	server.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Server.exeserver.execmd.exe

description	pid	process	target process
PID 2088 wrote to memory of 3008	2088	Server.exe	server.exe
PID 2088 wrote to memory of 3008	2088	Server.exe	server.exe
PID 2088 wrote to memory of 3008	2088	Server.exe	server.exe
PID 2088 wrote to memory of 3008	2088	Server.exe	server.exe
PID 3008 wrote to memory of 2692	3008	server.exe	netsh.exe
PID 3008 wrote to memory of 2692	3008	server.exe	netsh.exe
PID 3008 wrote to memory of 2692	3008	server.exe	netsh.exe
PID 3008 wrote to memory of 2692	3008	server.exe	netsh.exe
PID 3008 wrote to memory of 2036	3008	server.exe	netsh.exe
PID 3008 wrote to memory of 2036	3008	server.exe	netsh.exe
PID 3008 wrote to memory of 2036	3008	server.exe	netsh.exe
PID 3008 wrote to memory of 2036	3008	server.exe	netsh.exe
PID 3008 wrote to memory of 1320	3008	server.exe	cmd.exe
PID 3008 wrote to memory of 1320	3008	server.exe	cmd.exe
PID 3008 wrote to memory of 1320	3008	server.exe	cmd.exe
PID 3008 wrote to memory of 1320	3008	server.exe	cmd.exe
PID 1320 wrote to memory of 1844	1320	cmd.exe	PING.EXE
PID 1320 wrote to memory of 1844	1320	cmd.exe	PING.EXE
PID 1320 wrote to memory of 1844	1320	cmd.exe	PING.EXE
PID 1320 wrote to memory of 1844	1320	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\AppData\Roaming\server.exe
"C:\Users\Admin\AppData\Roaming\server.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2692

C:\Windows\SysWOW64\netsh.exe
netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
3⤵
- Modifies Windows Firewall
PID:2036

C:\Windows\SysWOW64\cmd.exe
cmd.exe /k ping 0 & del "C:\Users\Admin\AppData\Roaming\server.exe" & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\SysWOW64\PING.EXE
ping 0
4⤵
- Runs ping.exe
PID:1844

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\server.exe
Filesize
37KB

MD5
de43783b8b13388eb629c7675983def1

SHA1
9d8285f25c0e8d2a16fae6cba5d5dfbcf2c1d1f7

SHA256
0837d32cd4aabde333efdfc2695f522c07e505131b3d36cc12618be91a057290

SHA512
1052d7f2a2efb7543b970278f11e0b71410386fb7f8b1322ec14ec5681caf114e4f5ef2e30e1d3975207406559595a51d0e3c496de35a9bef6a3b58a6ca32a43

Download Submit
memory/2088-0-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/2088-1-0x0000000002440000-0x0000000002480000-memory.dmp

Filesize
256KB

Download
memory/2088-2-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/2088-10-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/3008-11-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/3008-12-0x0000000001F40000-0x0000000001F80000-memory.dmp

Filesize
256KB

Download
memory/3008-13-0x0000000001F40000-0x0000000001F80000-memory.dmp

Filesize
256KB

Download
memory/3008-14-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/3008-15-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing