njrat | 89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe
Size

114KB
MD5

43b54cfac304eeaa653ff9ffbe260427
SHA1

b65b4fb9a6e70f74dc34b2d5c474642a13e84222
SHA256

89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0
SHA512

b22fb5408f1412922e61ba0a1a73de9bbb7361490686420dfb0cb3542c202e8f1fa320938fb1ae2b8c39701dc151e73ee0dd883954f91c11e7640afe437d2277
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMiat6Aa:P5eznsjsguGDFqGZ2riAa

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2832 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

chargeable.exechargeable.exe

pid process

2116 chargeable.exe
2692 chargeable.exe

pid	process
2832	netsh.exe

pid	process
2116	chargeable.exe
2692	chargeable.exe

Loads dropped DLL 2 IoCs

Processes:

89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe

pid	process
2856	89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe
2856	89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe"	89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chargeable.exe

description pid process target process

PID 2116 set thread context of 2692 2116 chargeable.exe chargeable.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2116 set thread context of 2692	2116	chargeable.exe	chargeable.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

chargeable.exe

description	pid	process
Token: SeDebugPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe
Token: 33	2692	chargeable.exe
Token: SeIncBasePriorityPrivilege	2692	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exechargeable.exechargeable.exe

description	pid	process	target process
PID 2856 wrote to memory of 2116	2856	89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe	chargeable.exe
PID 2856 wrote to memory of 2116	2856	89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe	chargeable.exe
PID 2856 wrote to memory of 2116	2856	89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe	chargeable.exe
PID 2856 wrote to memory of 2116	2856	89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe	chargeable.exe
PID 2116 wrote to memory of 2692	2116	chargeable.exe	chargeable.exe
PID 2116 wrote to memory of 2692	2116	chargeable.exe	chargeable.exe
PID 2116 wrote to memory of 2692	2116	chargeable.exe	chargeable.exe
PID 2116 wrote to memory of 2692	2116	chargeable.exe	chargeable.exe
PID 2116 wrote to memory of 2692	2116	chargeable.exe	chargeable.exe
PID 2116 wrote to memory of 2692	2116	chargeable.exe	chargeable.exe
PID 2116 wrote to memory of 2692	2116	chargeable.exe	chargeable.exe
PID 2116 wrote to memory of 2692	2116	chargeable.exe	chargeable.exe
PID 2116 wrote to memory of 2692	2116	chargeable.exe	chargeable.exe
PID 2692 wrote to memory of 2832	2692	chargeable.exe	netsh.exe
PID 2692 wrote to memory of 2832	2692	chargeable.exe	netsh.exe
PID 2692 wrote to memory of 2832	2692	chargeable.exe	netsh.exe
PID 2692 wrote to memory of 2832	2692	chargeable.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe
"C:\Users\Admin\AppData\Local\Temp\89afd81cb7cb59382bf5830fd0111fd79a186532d960242e2e7e079415850ba0.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2856

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE
Filesize
1KB

MD5
cba2426f2aafe31899569ace05e89796

SHA1
3bfb16faefd762b18f033cb2de6ceb77db9d2390

SHA256
a465febe8a024e3cdb548a3731b2ea60c7b2919e941a24b9a42890b2b039b85a

SHA512
395cce81a7966f02c49129586815b833c8acfe6efbb8795e56548f32819270c654074622b7fa880121ce7fbd29725af6f69f89b8c7e02c64d1bbffbfe0620c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956
Filesize
1KB

MD5
0376ba21bc7c1d09e61b206c11bbc92c

SHA1
443fee1cb47f3497f1e8042a94c5da8655aa7cd7

SHA256
1e377d5df77b88b5dd8cde349ceb5c939eaddb2af2676ec91346f9ef7e24a0ab

SHA512
f68db4ce81924b2531b3467a23e02b2913086b6293d0d5a81fe9dbee941504502ea590d4667e3e758f3b4986384200700cb919bc7a5b75a29080e66b29aa9e23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE
Filesize
264B

MD5
010713aeca488733413e27c88a1bde1c

SHA1
7c627b7d1df471ae7b784655ab62f065d2511c2a

SHA256
0f0de57ea8ed2ecf143952d33522d968ccab1f9aa73a3b6100fdcfa99bf5ccb7

SHA512
d6e76d67607d71b53df04e10f8eb2907d764c0d44023b05f5dc8ae2ecae387fbe9cf2a8ebf58b26e89e952a0d1b08d1ac00b3ef42a4dc4f52aa7373db2c0bd26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
aee7ac2fba3f6aa4c9132c97cda9e2e9

SHA1
83aa792d59970d2ee5258a37e1538d9ebf24227d

SHA256
b99f74c919788dc0a94fad68512199a5d774aab2d5f359b3f091845452518478

SHA512
79c4f7d9c47f01537c0e3223ade749fe4b836eea244c2a0d82d328b0011df3006fd977e12d393aeb20329dbed30ae61a6008f5f9ec9bde113254b50bbb3d36a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ecdb65d3bb06594821fbc312e4266e31

SHA1
90d45e58e16397339ad06896c452909634b2606b

SHA256
fb872fcaf5e72c4fd254e797d8b24f2c60eca639b277862cb325903a9c3dcd7b

SHA512
43989c10ed8cdefbbfb02e841a2557452b0f9c4f92179b9be0824750ad2a047fb864401a9824cb88fb02f1a0a8e0601eddb73dbdad41632504dca30477a0b607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
78b0701ea1becae62bfc8c4e1d1e48d8

SHA1
261f320fdec330da51ff57fc9fcad61e7af6afd6

SHA256
9cd2d775443b066cf570449fe6a10bf7b11d0bc8566af08996510cc06836ab58

SHA512
50b363363827e15b7a7e4b59e88a2f633ecfeece6ce656f7b45e5498d427b66a18a8906e0e45592421d4d4449f2267b704a7a73d57ae6c328c0f8a193904dec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956
Filesize
252B

MD5
b1a090f3a904fe0e4a25081b38fbe424

SHA1
e0bc0b2fe4401607b0b9560d69d4ba960c33290a

SHA256
28b41ceb116508f9c000a6be4c42f3e5a6abf617514b55d7f54cd2d4c533eb09

SHA512
7b8bade9b621c815eb47c0a139d4b2dd3e686167d40b0a3a916d44a80dbaefe27eff02cb7787093faac2f375d532776f15a78ccd13c4bf0ac4c40ac296691b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab148C.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar149F.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1767.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Roaming\confuse\chargeable.exe
Filesize
114KB

MD5
e177f129887ed96373a9e27ba7278ed3

SHA1
10a147c5f3f7a7e6e9928daaa3801e3955dab0f1

SHA256
1bf8ca96c7e679700fbc42f04170c7ba55e9dfc1c68cbee0066336dea64ea2cb

SHA512
70e32134afd96a21e834ea658bd3a1896124c48060e1e9dfa388ada60f18537dde41715187a3d1a2d9461303b05ad65ba5222c9c9826e688187714f9b624e7e9

Download Submit
memory/2692-365-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2692-368-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2692-367-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2856-196-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2856-1-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2856-0-0x0000000074791000-0x0000000074792000-memory.dmp

Filesize
4KB

Download