njrat | 637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe
Size 115KB
Sample240530-2l4f2scc7t
SHA256 637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842
MD5 417ea6da50973714a0ffbedb6178f8b5
SHA1 f4841ead1fa379a4de01fd8a9652e967b5e1a004
SHA512 a76d036317e02edc880795c9a0ac31705b96b0deee5c9506cb7c6eb1a7a7ed09a128795ab8569c6c4c569b120915b935cfccedea675da31375a7d015a9a2dbf6
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL9:P5eznsjsguGDFqGZ2rDL9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2464	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2784	chargeable.exe
2708	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
1844	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe
1844	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe"	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 2708	2784	chargeable.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe
Token: 33	2708	chargeable.exe
Token: SeIncBasePriorityPrivilege	2708	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2784	1844	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe	28
PID 1844 wrote to memory of 2784	1844	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe	28
PID 1844 wrote to memory of 2784	1844	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe	28
PID 1844 wrote to memory of 2784	1844	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe	28
PID 2784 wrote to memory of 2708	2784	chargeable.exe	29
PID 2784 wrote to memory of 2708	2784	chargeable.exe	29
PID 2784 wrote to memory of 2708	2784	chargeable.exe	29
PID 2784 wrote to memory of 2708	2784	chargeable.exe	29
PID 2784 wrote to memory of 2708	2784	chargeable.exe	29
PID 2784 wrote to memory of 2708	2784	chargeable.exe	29
PID 2784 wrote to memory of 2708	2784	chargeable.exe	29
PID 2784 wrote to memory of 2708	2784	chargeable.exe	29
PID 2784 wrote to memory of 2708	2784	chargeable.exe	29
PID 2708 wrote to memory of 2464	2708	chargeable.exe	30
PID 2708 wrote to memory of 2464	2708	chargeable.exe	30
PID 2708 wrote to memory of 2464	2708	chargeable.exe	30
PID 2708 wrote to memory of 2464	2708	chargeable.exe	30

C:\Users\Admin\AppData\Local\Temp\637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe
"C:\Users\Admin\AppData\Local\Temp\637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 2b23d68f4308bba711a20b5ff93e542217f73b0b7c1ed3b716cf83e183c3bf12
MD5 3772066bd31241ef29104fd5538f3e36
SHA1 0ddc573947364a124ba3f96ed8f84b862e823db1
SHA512 c75a2d97ad78c7cd54a3683bcf348e809ec6490d77946b92e4d892ce063c9ed622eacbb92011ba9ab2c3e7d48e2c0ce45acee1394f6a4f5159483d8a5a4bd3c5
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 4d6e7e3ed349880061a73212e5b6d7f5b8d8d383732a82846fb392dc8d87dcdd
MD5 b6f0570571fcebb70a28df76c4307987
SHA1 e93724056f9e4a801132fa7d4740db412a31a87f
SHA512 ead380728f4de200fa58afee324bfd9a1d00d02a4b481ab247d729a4f686bc49f790bd8ae32ce6c0aca06848e480ed7e3af292ec479565848024f1192ae358d0
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 c4cc3009e43335cf225de74590fbfc1a5a77bb1949fd92acca541a49e278576c
MD5 ba4c2f38d8c7bfcb3de53d14cf457653
SHA1 2b6284639458a5355091fb4793dab9763bbe3429
SHA512 35e93af5f0bf49b721ddb016ab29ddabac5d777ec9a2149bd5724444bc4aed098d2b77dcb978a6cfea1f334ddfaf0dd8a60539d0a6db141c6fc4df726fa07115
MD5 SHA1 SHA512

Submit Download

Cab1F65.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab1F65.tmp
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar1F77.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar1F77.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar20F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar20F8.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

chargeable.exe

Path \Users\Admin\AppData\Roaming\confuse\chargeable.exe
Size 115KB
SHA256 50a7d1b667c28c6032fb5f645adbcf1ac41d8de59818bf7d73d0d30e0f21016d
MD5 ddec99daf32b8f98df114ebcd1672197
SHA1 93087d6114eb3695af3b4418efc646faaca0c3a0
SHA512 1b81c73846d58e59ee8fc5cbfbec81e61f4e30d63b173665bb179e01771b12d761a6b9f68af3c3eeb7d2a0fe27cbdfaff2cf65b8d60cc5ceabf64b40c9d49019
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLw:P5eznsjsguGDFqGZ2rDLw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1844-2-0x0000000074210000-0x00000000747BB000-memory.dmp

Download

memory/1844-190-0x0000000074210000-0x00000000747BB000-memory.dmp

Download

memory/1844-0-0x0000000074211000-0x0000000074212000-memory.dmp

Download

memory/2708-355-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2708-357-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2708-358-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads