njrat | fb92f4bcee1c79fb56625d8c7a4f3e1f3b6cee63567eb49b6138ef5224ba5486

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1DE7EB7A3B3F987C9826C23BF38E1AA4.exe
Size 115KB
Sample240602-m99kmsca98
SHA256 fb92f4bcee1c79fb56625d8c7a4f3e1f3b6cee63567eb49b6138ef5224ba5486
MD5 1de7eb7a3b3f987c9826c23bf38e1aa4
SHA1 34cc55771ab42b0b53f804fa0fb670c49bb7da89
SHA512 a102ee6311c260d7deac6e81f9f43f6616b3d47b07a2a5b4a26518624648bacca05be23054b66ae35d1b1782b4a179c8d5ee0e947431d0b15a5df103791856d9
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDQgd:P5eznsjsguGDFqGZ2rDtd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2796	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2132	chargeable.exe
1124	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
1700	1DE7EB7A3B3F987C9826C23BF38E1AA4.exe
1700	1DE7EB7A3B3F987C9826C23BF38E1AA4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1DE7EB7A3B3F987C9826C23BF38E1AA4.exe"	1DE7EB7A3B3F987C9826C23BF38E1AA4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	1DE7EB7A3B3F987C9826C23BF38E1AA4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 1124	2132	chargeable.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe
Token: 33	1124	chargeable.exe
Token: SeIncBasePriorityPrivilege	1124	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2132	1700	1DE7EB7A3B3F987C9826C23BF38E1AA4.exe	28
PID 1700 wrote to memory of 2132	1700	1DE7EB7A3B3F987C9826C23BF38E1AA4.exe	28
PID 1700 wrote to memory of 2132	1700	1DE7EB7A3B3F987C9826C23BF38E1AA4.exe	28
PID 1700 wrote to memory of 2132	1700	1DE7EB7A3B3F987C9826C23BF38E1AA4.exe	28
PID 2132 wrote to memory of 1124	2132	chargeable.exe	29
PID 2132 wrote to memory of 1124	2132	chargeable.exe	29
PID 2132 wrote to memory of 1124	2132	chargeable.exe	29
PID 2132 wrote to memory of 1124	2132	chargeable.exe	29
PID 2132 wrote to memory of 1124	2132	chargeable.exe	29
PID 2132 wrote to memory of 1124	2132	chargeable.exe	29
PID 2132 wrote to memory of 1124	2132	chargeable.exe	29
PID 2132 wrote to memory of 1124	2132	chargeable.exe	29
PID 2132 wrote to memory of 1124	2132	chargeable.exe	29
PID 1124 wrote to memory of 2796	1124	chargeable.exe	30
PID 1124 wrote to memory of 2796	1124	chargeable.exe	30
PID 1124 wrote to memory of 2796	1124	chargeable.exe	30
PID 1124 wrote to memory of 2796	1124	chargeable.exe	30

C:\Users\Admin\AppData\Local\Temp\1DE7EB7A3B3F987C9826C23BF38E1AA4.exe
"C:\Users\Admin\AppData\Local\Temp\1DE7EB7A3B3F987C9826C23BF38E1AA4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 45d9ae2907f55cb73f8447d8e985ed792dc169084ac214017255e765169eeff0
MD5 5b10fe4839469eb61c3afa0dfa5428f9
SHA1 5fcd11641d80dfbc9f2f33009303e8c60336357e
SHA512 c12c4ebfac5e96fb017eb9d3c423d472ca16a96e00685742e63e907985275f3d2b8d2fca59b5b8d185df718a7e899f0d8ebddd868af7d10ff5b97be1ab99ecd4
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 a832b3852a84323ce72e76c4061889e2d891ebf96dca9b6b0ad1b0b47f567e3d
MD5 c3a9e88875da49120deca806a1305ae2
SHA1 019e650453f3bb6ee3f68225f0c59ed6aaf7607d
SHA512 7b47fb18d7764ad796d5c18dfb0a142b01ab1fd371891a2b931fa419c713c0dae8a799ce0bb47b8a87ff800ef7eb937bc60b72c65c00412e0d824c3948f40bb4
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 f5d664d64b11dc58113bf0e311fbb47088a163c4d377adae88e18f1a15c2ed2e
MD5 81e4ffa8fc8ba161aec782ac1d20b247
SHA1 f1d890cf3706c16a45a389bbb68e19028ec0acdd
SHA512 0ecc813ceb974d9379049fbfcc991c5d7eef83497f98b977946683e55117798d4543eea56c13421af29a2884d729c8f3f3ff65adf5a43211eb86c5bbdfcb8c99
MD5 SHA1 SHA512

Submit Download

Cab1E5C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab1E5C.tmp
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar1E6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar1E6E.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar1FDF.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar1FDF.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

chargeable.exe

Path \Users\Admin\AppData\Roaming\confuse\chargeable.exe
Size 115KB
SHA256 8b917a1378e1b034d83470155af3db364c50d508ce1e604c31e1e67078730cc6
MD5 4427f824c10f79a8cd67b65cece5703f
SHA1 fac5bd90b45fc6627e72a72e07c09e4ecd942d9e
SHA512 31e7f8edceb796d004296b819ea5aa48e36ea779102c797e78c67c51b2b37b0b1b5b4f5b1656099c9594ff8b01ec82f2386eb0ce09fc474bdefa3b42faa20400
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDQgY:P5eznsjsguGDFqGZ2rDtY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1124-356-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1124-358-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1124-359-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1700-0-0x0000000074481000-0x0000000074482000-memory.dmp

Download

memory/1700-200-0x0000000074480000-0x0000000074A2B000-memory.dmp

Download

memory/1700-2-0x0000000074480000-0x0000000074A2B000-memory.dmp

Download

memory/1700-1-0x0000000074480000-0x0000000074A2B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads