njrat | a2437edff6ad2572fb977153bbd6f31f45f5507657e1bf450db84203e7e2cf0e

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe
Size

113KB
MD5

207a0a0f98f554f4b8ce5715f07514c6
SHA1

693f287b916c2376573aeff102827961ee1352f4
SHA256

7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed
SHA512

a7607294b616d99fc4f345bbcf0c038d0aeae3d207a340adccc0c20022168d71fe9e55fe3f2b0d9d8f6b00242f7995333761df3a47951ec124c9de501ca8a243
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMiaH:P5eznsjsguGDFqGZ2rZ

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2776	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
1628	chargeable.exe
2640	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
1744	7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe
1744	7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe"	7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 2640	1628	chargeable.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe
Token: 33	2640	chargeable.exe
Token: SeIncBasePriorityPrivilege	2640	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1628	1744	7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe	28
PID 1744 wrote to memory of 1628	1744	7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe	28
PID 1744 wrote to memory of 1628	1744	7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe	28
PID 1744 wrote to memory of 1628	1744	7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe	28
PID 1628 wrote to memory of 2640	1628	chargeable.exe	29
PID 1628 wrote to memory of 2640	1628	chargeable.exe	29
PID 1628 wrote to memory of 2640	1628	chargeable.exe	29
PID 1628 wrote to memory of 2640	1628	chargeable.exe	29
PID 1628 wrote to memory of 2640	1628	chargeable.exe	29
PID 1628 wrote to memory of 2640	1628	chargeable.exe	29
PID 1628 wrote to memory of 2640	1628	chargeable.exe	29
PID 1628 wrote to memory of 2640	1628	chargeable.exe	29
PID 1628 wrote to memory of 2640	1628	chargeable.exe	29
PID 2640 wrote to memory of 2776	2640	chargeable.exe	30
PID 2640 wrote to memory of 2776	2640	chargeable.exe	30
PID 2640 wrote to memory of 2776	2640	chargeable.exe	30
PID 2640 wrote to memory of 2776	2640	chargeable.exe	30

C:\Users\Admin\AppData\Local\Temp\7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe
"C:\Users\Admin\AppData\Local\Temp\7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956

Filesize
1KB

MD5
0376ba21bc7c1d09e61b206c11bbc92c

SHA1
443fee1cb47f3497f1e8042a94c5da8655aa7cd7

SHA256
1e377d5df77b88b5dd8cde349ceb5c939eaddb2af2676ec91346f9ef7e24a0ab

SHA512
f68db4ce81924b2531b3467a23e02b2913086b6293d0d5a81fe9dbee941504502ea590d4667e3e758f3b4986384200700cb919bc7a5b75a29080e66b29aa9e23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81d868caac8773c9553de5fec2201264

SHA1
0b584f0dcb730dcecacafccbbb62580558c30ed9

SHA256
6b08d3a799a467eec8f6f79f7af1237755b4f15843f9e8e87f8880f550b598b8

SHA512
e57f5fa31c1641eaeda0b5cda7ed3deece0e6297526df756abf9e3993ab5f309d30f5e1079f081a8ec42c3700d3e4b21a9bbc2985071228900000c12adfbfde2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f28734d35523c0379ecf699252e2ee84

SHA1
16b736ea0e4b2cbe4e2a874e54ceacc6872c299e

SHA256
fb1e9aa39cf37bddf9e85f3b4dc1a584f3ea40030b2f456f3fc8b0c46ee1557b

SHA512
2ef0255f8e2cae1953b9b446a98db37b95408b166d05de8d0f4ae5807a8b6a691b830cbd4be8960d884d2774b54801d68046fe3bd14318e16a4639d7fb167e27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d19eb5a840710cf85f87820d8c186d03

SHA1
ef46b28543ad0312bc421b77b8a5539731debec1

SHA256
e4a4279edbc816a145cf1bac21725d7d3fa732b96adb1ec78f6fae92e076c5fa

SHA512
91d4fb815ee40bf47f3ce8b9dda572b9908417de4e16c08aaa835bd6caa843570ad99c775d91d1bdc87ddcab23a04683152736ea7e44e5cca4a87101c3829eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956

Filesize
252B

MD5
d85dedd846257dcc4d62c9dce018656b

SHA1
95f3ba85b820b4f9249f5212d2d3cdfcaae57177

SHA256
60287e92a0395697ad15dfd42ae11e00fd9cda523e9f1fa53aed7f2dfad81e77

SHA512
07fe3799da76c69f7904f297c4c4fa8f3e05d3f9905feee12cda4a3ae51689a9bfc90d1f6f14854d8ce58ac52d706c14aca7dd244d7c920f76eb2843af6284c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2780.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2792.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2961.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Filesize
113KB

MD5
7cb05a7b80ad0e4d6147e2779d62122b

SHA1
d6769b34a3c3cfb162f0fb83c290e1e7e3a36c57

SHA256
21f4e407902c1f2c2a1c79c83304eb5e51710c4046a80f3079c29639f0ede961

SHA512
032e852827a8dea03db64e9f36487c788b02dc92f6366d3dbab556f6498a54c528211f147ba5435eff2762aa0f465b3c59b89e1e5110e2b86fcc6b678fbb7d63

Download Submit
memory/1628-205-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1628-371-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1628-194-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1628-363-0x0000000000810000-0x0000000000850000-memory.dmp

Filesize
256KB

Download
memory/1628-195-0x0000000000810000-0x0000000000850000-memory.dmp

Filesize
256KB

Download
memory/1744-0-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-193-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-8-0x0000000000D50000-0x0000000000D90000-memory.dmp

Filesize
256KB

Download
memory/2640-364-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2640-369-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2640-372-0x00000000003B0000-0x00000000003F0000-memory.dmp

Filesize
256KB

Download
memory/2640-367-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2640-370-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/2640-373-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/2640-374-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads