njrat | b9418ffff1fdc91b3257ef2c42e6edc1605b38f2534e93c4f487a72f98279496

General

Target

Server3.exe
Size

37KB
MD5

9572900a67ed67c643c7298b951d2104
SHA1

e3b7291e39cafe608ffbeadba8135658d22dde2f
SHA256

b9418ffff1fdc91b3257ef2c42e6edc1605b38f2534e93c4f487a72f98279496
SHA512

07a115cfb2d5a97f06a10740c1e0f5ef9fb13bb248e6fbf1d7a815fe7139d7d499d4dfc638fe6544012bfa27b324535487b8446234edd4480e0b0446f8f22173
SSDEEP

384:rkc6ikDRxdDsyNyyszPIRPr28msD+rAF+rMRTyN/0L+EcoinblneHQM3epzXoNC/:ADeyNBszPIRy1sqrM+rMRa8NuKgt

Score

10^/10

njrat abusharaf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

AbuSharaf

C2

every-unnecessary.gl.at.ply.gg:41021

Mutex

bcf19f19ec90f55db9d548f83598227f

Attributes

reg_key
bcf19f19ec90f55db9d548f83598227f
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3036 netsh.exe

pid	process
3036	netsh.exe

Drops startup file 2 IoCs

Processes:

Windows.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcf19f19ec90f55db9d548f83598227f.exe	Windows.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcf19f19ec90f55db9d548f83598227f.exe	Windows.exe

Executes dropped EXE 1 IoCs

Processes:

Windows.exe

pid process

2816 Windows.exe
Loads dropped DLL 1 IoCs

Processes:

Server3.exe

pid process

1412 Server3.exe

pid	process
1412	Server3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Windows.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\bcf19f19ec90f55db9d548f83598227f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .."	Windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bcf19f19ec90f55db9d548f83598227f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .."	Windows.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

Windows.exe

description	ioc	process
File created	D:\autorun.inf	Windows.exe
File created	F:\autorun.inf	Windows.exe
File opened for modification	F:\autorun.inf	Windows.exe
File created	C:\autorun.inf	Windows.exe
File opened for modification	C:\autorun.inf	Windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2896 taskkill.exe

pid	process
2896	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Windows.exe

pid	process
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe
2816	Windows.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Windows.exe

pid process

2816 Windows.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

Windows.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2816	Windows.exe
Token: SeDebugPrivilege	2896	taskkill.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe
Token: 33	2816	Windows.exe
Token: SeIncBasePriorityPrivilege	2816	Windows.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Server3.exeWindows.exe

description	pid	process	target process
PID 1412 wrote to memory of 2816	1412	Server3.exe	Windows.exe
PID 1412 wrote to memory of 2816	1412	Server3.exe	Windows.exe
PID 1412 wrote to memory of 2816	1412	Server3.exe	Windows.exe
PID 1412 wrote to memory of 2816	1412	Server3.exe	Windows.exe
PID 2816 wrote to memory of 3036	2816	Windows.exe	netsh.exe
PID 2816 wrote to memory of 3036	2816	Windows.exe	netsh.exe
PID 2816 wrote to memory of 3036	2816	Windows.exe	netsh.exe
PID 2816 wrote to memory of 3036	2816	Windows.exe	netsh.exe
PID 2816 wrote to memory of 2896	2816	Windows.exe	taskkill.exe
PID 2816 wrote to memory of 2896	2816	Windows.exe	taskkill.exe
PID 2816 wrote to memory of 2896	2816	Windows.exe	taskkill.exe
PID 2816 wrote to memory of 2896	2816	Windows.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\Server3.exe
"C:\Users\Admin\AppData\Local\Temp\Server3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1412

C:\Users\Admin\AppData\Local\Temp\Windows.exe
"C:\Users\Admin\AppData\Local\Temp\Windows.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Windows.exe" "Windows.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:3036

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Exsample.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Windows.exe

Filesize
37KB

MD5
9572900a67ed67c643c7298b951d2104

SHA1
e3b7291e39cafe608ffbeadba8135658d22dde2f

SHA256
b9418ffff1fdc91b3257ef2c42e6edc1605b38f2534e93c4f487a72f98279496

SHA512
07a115cfb2d5a97f06a10740c1e0f5ef9fb13bb248e6fbf1d7a815fe7139d7d499d4dfc638fe6544012bfa27b324535487b8446234edd4480e0b0446f8f22173

Download Submit
memory/1412-0-0x0000000074021000-0x0000000074022000-memory.dmp

Filesize
4KB

Download
memory/1412-1-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/1412-2-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/1412-10-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/2816-11-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/2816-12-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/2816-13-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download
memory/2816-23-0x0000000074020000-0x00000000745CB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads