njrat | bdd4c71987f7e0d8bdd4d4e8ec91ed729b280dfda65e653eb0d4bb4dccbb8b2f

General

Target

d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe
Size

114KB
MD5

d01941c76c15122c1da56ea88bc3fba0
SHA1

faf82a02e1536d4d11f183f344208b0ee39d5178
SHA256

bdd4c71987f7e0d8bdd4d4e8ec91ed729b280dfda65e653eb0d4bb4dccbb8b2f
SHA512

4153d0d2b5b837a543bab2098d2abf5d283f1e89ccedb31c79252f89b183b61c06b0456b796f253218cddc7d7128efdfc3ad76d6bf04ff5d1db5b2f06140d277
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDj:P5eznsjsguGDFqGZ2rDj

Score

10^/10

njrat neuf persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe

Executes dropped EXE 2 IoCs

pid	Process
4532	chargeable.exe
4996	chargeable.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe"	d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4532 set thread context of 4996	4532	chargeable.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4444	4996	WerFault.exe	88

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4532	4704	d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe	87
PID 4704 wrote to memory of 4532	4704	d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe	87
PID 4704 wrote to memory of 4532	4704	d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe	87
PID 4532 wrote to memory of 4996	4532	chargeable.exe	88
PID 4532 wrote to memory of 4996	4532	chargeable.exe	88
PID 4532 wrote to memory of 4996	4532	chargeable.exe	88
PID 4532 wrote to memory of 4996	4532	chargeable.exe	88
PID 4532 wrote to memory of 4996	4532	chargeable.exe	88
PID 4532 wrote to memory of 4996	4532	chargeable.exe	88
PID 4532 wrote to memory of 4996	4532	chargeable.exe	88
PID 4532 wrote to memory of 4996	4532	chargeable.exe	88

C:\Users\Admin\AppData\Local\Temp\d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d01941c76c15122c1da56ea88bc3fba0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    PID:4996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 152
      4⤵
      Program crash
      PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4996 -ip 4996
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Filesize
114KB

MD5
19b88f43c4bb0edcdb697bf1d311c17d

SHA1
62eaef923d06d808da46f7f2f49306a9e917515e

SHA256
1eaedfd9d2f7e37df46b5dedc828d24b4591640bd286e91777fd66b95120ef37

SHA512
92f7f08431b6ef9376ae5671538e659ec4f4108af85084095907f3683647d696903ca5f07f36ecf359b7a59010f60359b83704b7ccecaca791164b62185cb93a

Download Submit
memory/4532-18-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4532-19-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4532-20-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4532-24-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4704-0-0x0000000075202000-0x0000000075203000-memory.dmp

Filesize
4KB

Download
memory/4704-1-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4704-2-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4704-17-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/4996-21-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads