njrat | 637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe
Size 115KB
Sample240530-2l4f2scc7t
SHA256 637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842
MD5 417ea6da50973714a0ffbedb6178f8b5
SHA1 f4841ead1fa379a4de01fd8a9652e967b5e1a004
SHA512 a76d036317e02edc880795c9a0ac31705b96b0deee5c9506cb7c6eb1a7a7ed09a128795ab8569c6c4c569b120915b935cfccedea675da31375a7d015a9a2dbf6
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL9:P5eznsjsguGDFqGZ2rDL9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4808	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe

Executes dropped EXE 3 IoCs

pid	Process
4384	chargeable.exe
4748	chargeable.exe
3372	chargeable.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe"	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4384 set thread context of 3372	4384	chargeable.exe	110
PID 4384 set thread context of 4748	4384	chargeable.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	4748	WerFault.exe	109

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe
Token: 33	3372	chargeable.exe
Token: SeIncBasePriorityPrivilege	3372	chargeable.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4384	1800	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe	106
PID 1800 wrote to memory of 4384	1800	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe	106
PID 1800 wrote to memory of 4384	1800	637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe	106
PID 4384 wrote to memory of 4748	4384	chargeable.exe	109
PID 4384 wrote to memory of 4748	4384	chargeable.exe	109
PID 4384 wrote to memory of 4748	4384	chargeable.exe	109
PID 4384 wrote to memory of 3372	4384	chargeable.exe	110
PID 4384 wrote to memory of 3372	4384	chargeable.exe	110
PID 4384 wrote to memory of 3372	4384	chargeable.exe	110
PID 4384 wrote to memory of 3372	4384	chargeable.exe	110
PID 4384 wrote to memory of 3372	4384	chargeable.exe	110
PID 4384 wrote to memory of 3372	4384	chargeable.exe	110
PID 4384 wrote to memory of 3372	4384	chargeable.exe	110
PID 4384 wrote to memory of 3372	4384	chargeable.exe	110
PID 4384 wrote to memory of 4748	4384	chargeable.exe	109
PID 4384 wrote to memory of 4748	4384	chargeable.exe	109
PID 4384 wrote to memory of 4748	4384	chargeable.exe	109
PID 4384 wrote to memory of 4748	4384	chargeable.exe	109
PID 4384 wrote to memory of 4748	4384	chargeable.exe	109
PID 3372 wrote to memory of 4808	3372	chargeable.exe	114
PID 3372 wrote to memory of 4808	3372	chargeable.exe	114
PID 3372 wrote to memory of 4808	3372	chargeable.exe	114

C:\Users\Admin\AppData\Local\Temp\637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe
"C:\Users\Admin\AppData\Local\Temp\637f86678528526292b13907691aabc04ace15a4c8e42d64ba78e73203e42842.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 80
      4⤵
      Program crash
      PID:1196
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4748 -ip 4748
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chargeable.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\chargeable.exe.log
Size 400B
SHA256 c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
MD5 0a9b4592cd49c3c21f6767c2dabda92f
SHA1 f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA512 6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
MD5 SHA1 SHA512

Submit Download

chargeable.exe

Path C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
Size 115KB
SHA256 56fd28fde4005f7bb8e61c3d4529cbd3bc04c4a3fb058f72616540aef9a0c4d7
MD5 1af61a76df5c7c2d97899aedc2906dce
SHA1 50eb366bc3896d9fb600a96a01d0e6f52c8efb32
SHA512 c3236925d639ac976ade4258780f62545dd6cea907ee0c0784d8b1fdb1b349328887f076c42b2da1086971a943ddb3da4b6c7ed8e8a20cb9abc8a2276f99764d
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLE:P5eznsjsguGDFqGZ2rDLE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1800-1-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Download

memory/1800-2-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Download

memory/1800-17-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Download

memory/1800-0-0x00000000748F2000-0x00000000748F3000-memory.dmp

Download

memory/3372-26-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Download

memory/3372-20-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3372-27-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Download

memory/3372-29-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Download

memory/4384-19-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Download

memory/4384-18-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Download

memory/4384-28-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads