njrat | 731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca

General

Target

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe
Size

3.5MB
MD5

776741bc808602c987aba9cc5efd69cd
SHA1

50f8b6523c0722e36cfb48565fea8206bfdae18c
SHA256

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca
SHA512

a2eb805f4a53d2c47371a60369c4d8892b45221c845ce7214675d09610b45964a72fe1e268228807a9011ffd28e11fda8a5ca32d1cd412942931a703a38dcb2c
SSDEEP

49152:iaNR9UiP8mqlTlIt5olidaPIHMbq0GsoPeBMjTl+qK33x/:i49UrtnIE5wsbbomCPhKR

Score

10^/10

njrat persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe

Executes dropped EXE 3 IoCs

Processes:

svchost.exeServer.exeServer.exe

pid process

2464 svchost.exe
2640 Server.exe
1688 Server.exe
Loads dropped DLL 1 IoCs

Processes:

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe

pid process

2872 731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe

pid	process
2464	svchost.exe
2640	Server.exe
1688	Server.exe

pid	process
2872	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

2 0.tcp.eu.ngrok.io
7 0.tcp.eu.ngrok.io
10 0.tcp.eu.ngrok.io
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2560 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exesvchost.exe

pid process

2872 731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe
2464 svchost.exe

flow	ioc
2	0.tcp.eu.ngrok.io
7	0.tcp.eu.ngrok.io
10	0.tcp.eu.ngrok.io

pid	process
2560	schtasks.exe

pid	process
2872	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe
2464	svchost.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe
Token: 33	2464	svchost.exe
Token: SeIncBasePriorityPrivilege	2464	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exesvchost.exetaskeng.exe

description	pid	process	target process
PID 2872 wrote to memory of 2464	2872	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe	svchost.exe
PID 2872 wrote to memory of 2464	2872	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe	svchost.exe
PID 2872 wrote to memory of 2464	2872	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe	svchost.exe
PID 2872 wrote to memory of 2464	2872	731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe	svchost.exe
PID 2464 wrote to memory of 2560	2464	svchost.exe	schtasks.exe
PID 2464 wrote to memory of 2560	2464	svchost.exe	schtasks.exe
PID 2464 wrote to memory of 2560	2464	svchost.exe	schtasks.exe
PID 2464 wrote to memory of 2560	2464	svchost.exe	schtasks.exe
PID 1624 wrote to memory of 2640	1624	taskeng.exe	Server.exe
PID 1624 wrote to memory of 2640	1624	taskeng.exe	Server.exe
PID 1624 wrote to memory of 2640	1624	taskeng.exe	Server.exe
PID 1624 wrote to memory of 2640	1624	taskeng.exe	Server.exe
PID 1624 wrote to memory of 1688	1624	taskeng.exe	Server.exe
PID 1624 wrote to memory of 1688	1624	taskeng.exe	Server.exe
PID 1624 wrote to memory of 1688	1624	taskeng.exe	Server.exe
PID 1624 wrote to memory of 1688	1624	taskeng.exe	Server.exe

C:\Users\Admin\AppData\Local\Temp\731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe
"C:\Users\Admin\AppData\Local\Temp\731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2872

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
3⤵
- Creates scheduled task(s)
PID:2560

C:\Windows\system32\taskeng.exe
taskeng.exe {93176E9E-FBEE-44DF-B455-7946227940FD} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:2640

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
2⤵
- Executes dropped EXE
PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\svchost.exe
Filesize
3.5MB

MD5
776741bc808602c987aba9cc5efd69cd

SHA1
50f8b6523c0722e36cfb48565fea8206bfdae18c

SHA256
731094233c490cbf7562f7e84e0bc99052e3d74adf315a22be30377800dbd2ca

SHA512
a2eb805f4a53d2c47371a60369c4d8892b45221c845ce7214675d09610b45964a72fe1e268228807a9011ffd28e11fda8a5ca32d1cd412942931a703a38dcb2c

Download Submit
memory/2464-10-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2464-11-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2464-12-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2464-16-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2464-17-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2872-0-0x0000000074471000-0x0000000074472000-memory.dmp

Filesize
4KB

Download
memory/2872-1-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2872-2-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2872-13-0x0000000074470000-0x0000000074A1B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads