njrat | 1ae11a30e1d4021c5335ded1f2b25ed86834b20bc38b334fe897ab16fc15224c

Analysis

max time kernel
147s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05b296b871b9960925421fb5bae54f1e.exe
Size 113KB
Sample240520-259geabc2v
SHA256 1ae11a30e1d4021c5335ded1f2b25ed86834b20bc38b334fe897ab16fc15224c
MD5 05b296b871b9960925421fb5bae54f1e
SHA1 650e461dd26fc76086dc4826ff1a48d7628a1fe1
SHA512 3c74705a4bb4818718855ddb80a9775598e23717887fa252b63f82e411317f12c269d204dc0ef849a4f55be484942015ae869f0074842338794c7409c19ca713
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuM/:P5eznsjsguGDFqGZ2r/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2472	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
1740	chargeable.exe
2636	chargeable.exe
2660	chargeable.exe
2676	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
1988	05b296b871b9960925421fb5bae54f1e.exe
1988	05b296b871b9960925421fb5bae54f1e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	05b296b871b9960925421fb5bae54f1e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05b296b871b9960925421fb5bae54f1e.exe"	05b296b871b9960925421fb5bae54f1e.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 2660	1740	chargeable.exe	31
PID 1740 set thread context of 2636	1740	chargeable.exe	30
PID 1740 set thread context of 2676	1740	chargeable.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1740	1988	05b296b871b9960925421fb5bae54f1e.exe	28
PID 1988 wrote to memory of 1740	1988	05b296b871b9960925421fb5bae54f1e.exe	28
PID 1988 wrote to memory of 1740	1988	05b296b871b9960925421fb5bae54f1e.exe	28
PID 1988 wrote to memory of 1740	1988	05b296b871b9960925421fb5bae54f1e.exe	28
PID 1740 wrote to memory of 2676	1740	chargeable.exe	29
PID 1740 wrote to memory of 2676	1740	chargeable.exe	29
PID 1740 wrote to memory of 2676	1740	chargeable.exe	29
PID 1740 wrote to memory of 2676	1740	chargeable.exe	29
PID 1740 wrote to memory of 2636	1740	chargeable.exe	30
PID 1740 wrote to memory of 2636	1740	chargeable.exe	30
PID 1740 wrote to memory of 2636	1740	chargeable.exe	30
PID 1740 wrote to memory of 2636	1740	chargeable.exe	30
PID 1740 wrote to memory of 2660	1740	chargeable.exe	31
PID 1740 wrote to memory of 2660	1740	chargeable.exe	31
PID 1740 wrote to memory of 2660	1740	chargeable.exe	31
PID 1740 wrote to memory of 2660	1740	chargeable.exe	31
PID 1740 wrote to memory of 2660	1740	chargeable.exe	31
PID 1740 wrote to memory of 2660	1740	chargeable.exe	31
PID 1740 wrote to memory of 2660	1740	chargeable.exe	31
PID 1740 wrote to memory of 2660	1740	chargeable.exe	31
PID 1740 wrote to memory of 2660	1740	chargeable.exe	31
PID 1740 wrote to memory of 2636	1740	chargeable.exe	30
PID 1740 wrote to memory of 2636	1740	chargeable.exe	30
PID 1740 wrote to memory of 2636	1740	chargeable.exe	30
PID 1740 wrote to memory of 2636	1740	chargeable.exe	30
PID 1740 wrote to memory of 2636	1740	chargeable.exe	30
PID 1740 wrote to memory of 2676	1740	chargeable.exe	29
PID 1740 wrote to memory of 2676	1740	chargeable.exe	29
PID 1740 wrote to memory of 2676	1740	chargeable.exe	29
PID 1740 wrote to memory of 2676	1740	chargeable.exe	29
PID 1740 wrote to memory of 2676	1740	chargeable.exe	29
PID 2660 wrote to memory of 2472	2660	chargeable.exe	32
PID 2660 wrote to memory of 2472	2660	chargeable.exe	32
PID 2660 wrote to memory of 2472	2660	chargeable.exe	32
PID 2660 wrote to memory of 2472	2660	chargeable.exe	32

C:\Users\Admin\AppData\Local\Temp\05b296b871b9960925421fb5bae54f1e.exe
"C:\Users\Admin\AppData\Local\Temp\05b296b871b9960925421fb5bae54f1e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    PID:2676
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    PID:2636
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37C951188967C8EB88D99893D9D191FE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE
Size 1KB
SHA256 a465febe8a024e3cdb548a3731b2ea60c7b2919e941a24b9a42890b2b039b85a
MD5 cba2426f2aafe31899569ace05e89796
SHA1 3bfb16faefd762b18f033cb2de6ceb77db9d2390
SHA512 395cce81a7966f02c49129586815b833c8acfe6efbb8795e56548f32819270c654074622b7fa880121ce7fbd29725af6f69f89b8c7e02c64d1bbffbfe0620c68
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

C0018BB1B5834735BFA60CD063B31956

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956
Size 1KB
SHA256 1e377d5df77b88b5dd8cde349ceb5c939eaddb2af2676ec91346f9ef7e24a0ab
MD5 0376ba21bc7c1d09e61b206c11bbc92c
SHA1 443fee1cb47f3497f1e8042a94c5da8655aa7cd7
SHA512 f68db4ce81924b2531b3467a23e02b2913086b6293d0d5a81fe9dbee941504502ea590d4667e3e758f3b4986384200700cb919bc7a5b75a29080e66b29aa9e23
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

37C951188967C8EB88D99893D9D191FE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE
Size 264B
SHA256 f3dc48164cf9f08e6c457430b12eb1e3c9ed1689843d7f5eb9a209869f6b81b8
MD5 0e85cc85360ad8efa87ff75f5e7d5958
SHA1 ce9e3b091fe2fec98dfe2d43a3e06ff61c22eec6
SHA512 43b460d3b932b36992219a39dea1a6f1cccc0124e3f1cbac6b286971f8ae3dc5eb35aeff201882c8ce4bbca2484869f6cb5cf9de2f395e91763739ecd4efc533
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 4de1651fd3a9ec9919fa247755af3b556c8d2b24349667c02b0dc7de8af29003
MD5 5c647436fbd2b4109f9ed94a40e6ee94
SHA1 8aa23f0ff5252d417a2f4d8b11d55be7e43654a0
SHA512 59c95791478cc28b41e0c76478015c2c4ea25b2e005ca384af49bcbbc5fe26b0e7c0b5624403b7dd66cd84c48008255caf38e4a25930c517801d4f3b8ca2b11d
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 a6a72a699b62b53d680c2cd83172c057e264870f1dfe7323da99054a0cfd32f4
MD5 d897d4d83063ffe2a139a70145b90f30
SHA1 b5911dff16a298ccdf6352454421900848db273f
SHA512 4830c0715c134aa3b34a050ff63f571301ea3c6f7b8769e13e64d36ea754cfbf4049a5b083eb5d331b9509ca8962054dba4da04c0ac48daa678810ecc26ea3c5
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 a62763fa9fc597ad95958950e356a9df291439d3780b3cff23946ead7fc024e0
MD5 cf917a664f7cb166f912d7b066d2b912
SHA1 7873ab501db91fc7a11045a81e033f25ec07626c
SHA512 c7c7a994225ee8be7271062eb5d5539e01c492cad02eef50ff3aed98444b505b147ffd791036f22c4eaa413be38e32676b8491897547b82bcf841a32f0e1b44e
MD5 SHA1 SHA512

Submit Download

C0018BB1B5834735BFA60CD063B31956

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956
Size 252B
SHA256 38ee9c4d617f839a908c16686924c4e9f32c869d68e140ff569294b4c9a364e7
MD5 5171224d7f1bd31e445468304968a04b
SHA1 725edbd3123935e4a1324428e3c18110829b3300
SHA512 9d110a676fcca39570f0f77c41d9b1574620f1f18af00c56742071523b27118eafa39f4468ed97cd645b6706e82c35a63caca611298cfe09bf109bdb20b5c1da
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 742ed9984f1206b62b9eb825518449e9e6db6c56bfe9ddf397b48ac11b4976fb
MD5 d6fa27916aa5d824e0a4e7f2cc50c089
SHA1 c6c7382b37d051aeb1733fbd43040a7de9322d70
SHA512 d1b2a2a889aabce53073e07e9a7b12da011ad6bad928f3f51f9775567d029bc0229dc4f1e7d9723b0664e170c364bb897d88e345866116842042e36a2c465e79
MD5 SHA1 SHA512

Submit Download

Tar1319.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar1319.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

chargeable.exe

Path \Users\Admin\AppData\Roaming\confuse\chargeable.exe
Size 113KB
SHA256 d2cb1f1be3c7c8833d9fa233d9d7b8842fa10ab7e20693ea8808dbbbf09afbdb
MD5 8440d03ccf877f85016872fcf9f23028
SHA1 f4e69ad4dd072be2368811b5709afa7f821a2806
SHA512 366fa92cf9cf34f5b30d55928a1a3edf19586ad24695be86231d0fbe7a2a2fbd6a541dda84ceaf6a208ca88d317f0ae905f453dfdb60d7de2fc67948e8034610
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMH:P5eznsjsguGDFqGZ2rH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1988-192-0x0000000074030000-0x00000000745DB000-memory.dmp

Download

memory/1988-0-0x0000000074031000-0x0000000074032000-memory.dmp

Download

memory/1988-2-0x0000000074030000-0x00000000745DB000-memory.dmp

Download

memory/1988-1-0x0000000074030000-0x00000000745DB000-memory.dmp

Download

memory/2660-363-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2660-369-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2660-370-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads