njrat | b2296bd08bc881e0c17c5c235b7b9fd570865b4475b71e4aa623d5d12885825a

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe
Size 109KB
Sample240507-l5en2aeb82
SHA256 b2296bd08bc881e0c17c5c235b7b9fd570865b4475b71e4aa623d5d12885825a
MD5 36ccf0d2f3135f6dc27f0dd3c294bd40
SHA1 1f0ce3419db2ed05840ac797b45e05d3ab3a9889
SHA512 532c303fc15d5c9a5e7707d48338bda25ef0ed808127c8e1e2f0dee77f209d1651261ce5c24e9e184c2954473aee825e158e82fb6031699a8d3b4874b1294ff9
SSDEEP 1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBhi:w5eznsjsguGDFqGx8egoxmO3i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4556	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe

Executes dropped EXE 2 IoCs

pid	Process
2940	chargeable.exe
4872	chargeable.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe"	36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 4872	2940	chargeable.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe
Token: 33	4872	chargeable.exe
Token: SeIncBasePriorityPrivilege	4872	chargeable.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2940	4940	36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe	95
PID 4940 wrote to memory of 2940	4940	36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe	95
PID 4940 wrote to memory of 2940	4940	36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe	95
PID 2940 wrote to memory of 4872	2940	chargeable.exe	98
PID 2940 wrote to memory of 4872	2940	chargeable.exe	98
PID 2940 wrote to memory of 4872	2940	chargeable.exe	98
PID 2940 wrote to memory of 4872	2940	chargeable.exe	98
PID 2940 wrote to memory of 4872	2940	chargeable.exe	98
PID 2940 wrote to memory of 4872	2940	chargeable.exe	98
PID 2940 wrote to memory of 4872	2940	chargeable.exe	98
PID 2940 wrote to memory of 4872	2940	chargeable.exe	98
PID 4872 wrote to memory of 4556	4872	chargeable.exe	99
PID 4872 wrote to memory of 4556	4872	chargeable.exe	99
PID 4872 wrote to memory of 4556	4872	chargeable.exe	99

C:\Users\Admin\AppData\Local\Temp\36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\36ccf0d2f3135f6dc27f0dd3c294bd40_NEAS.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chargeable.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\chargeable.exe.log
Size 400B
SHA256 38615066450a66b2950aa946bf8eea01f16e1f0dfc7c0748609e195c317c2a7a
MD5 af005173cce1850423f0f999693487cb
SHA1 950bf700178ab02d75b959cf92f1d493acba31ef
SHA512 feb37c884eba52c5e74a3a9b1c604d42e6b25b98a1389ba9677361f756897d169824b9d7c214e150f6a1f07e7e63440baa07e6119aa08b919db0533a9fdb22bc
MD5 SHA1 SHA512

Submit Download

chargeable.exe

Path C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
Size 109KB
SHA256 7acde1c7c553945a06eb173358bf3e5a602b3c4c7089467fce1ec9f5cc7d03da
MD5 7783fd6cf16f443aae507165034adec3
SHA1 5909da55c1a932d68e2b1490ac4bf4ec988b5612
SHA512 d9a7c6727faacf8ffa880a03c5fceb14a6087187bc1c88957bdc677b5e79e7c9397ac0c2d3d3f9123b3de2ca653c7de15b7ca0530e08be1862f0fcf630d7d5b8
SSDEEP 1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBhr:w5eznsjsguGDFqGx8egoxmO3r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2940-19-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/2940-18-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/2940-25-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/4872-20-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4872-24-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/4872-26-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/4872-27-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/4940-2-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/4940-17-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/4940-0-0x0000000075562000-0x0000000075563000-memory.dmp

Download

memory/4940-1-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads