njrat | f9b46c5b76da6de70ce500a3d03fc395da2c36b1fe3a1bc37ad6588626f00514

Analysis

max time kernel
134s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02/06/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RBXFlox.exe
Size 364KB
Sample240602-vr15jshc8w
SHA256 f9b46c5b76da6de70ce500a3d03fc395da2c36b1fe3a1bc37ad6588626f00514
MD5 35db26be771dc5ed21916b41f120b96f
SHA1 9d26bc0a849efde1912f4b78dfd2a94fdd1ee741
SHA512 7f047af462539dceea48ec775c12565e0bbf101b279f42a81b8847f096d8ff6823396065a3296c9bbe9eb560408d24c413ead121df97a3fe23d9e4ac379e634f
SSDEEP 6144:fgZiAEAO0sByNsAal3gVAWgS7/OhwjjN2eawlb8NwC:fgZXEAO/BUdG3gVdt7Ky0eawd8NwC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat zona loxov evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

ZONA LOXOV

tips-prairie.at.ply.gg:23521

Mutex

050e77055b5594c9d6229033038c9670

Attributes

reg_key
050e77055b5594c9d6229033038c9670
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2736	netsh.exe
4404	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\050e77055b5594c9d6229033038c9670.exe	conhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\050e77055b5594c9d6229033038c9670.exe	conhost.exe

Executes dropped EXE 2 IoCs

pid	Process
4656	svchost.exe
428	conhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\050e77055b5594c9d6229033038c9670 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .."	conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\050e77055b5594c9d6229033038c9670 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .."	conhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4208	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe
428	conhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	428	conhost.exe
Token: 33	428	conhost.exe
Token: SeIncBasePriorityPrivilege	428	conhost.exe
Token: 33	428	conhost.exe
Token: SeIncBasePriorityPrivilege	428	conhost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4656	3152	RBXFlox.exe	73
PID 3152 wrote to memory of 4656	3152	RBXFlox.exe	73
PID 3152 wrote to memory of 4656	3152	RBXFlox.exe	73
PID 4656 wrote to memory of 428	4656	svchost.exe	75
PID 4656 wrote to memory of 428	4656	svchost.exe	75
PID 4656 wrote to memory of 428	4656	svchost.exe	75
PID 428 wrote to memory of 2736	428	conhost.exe	76
PID 428 wrote to memory of 2736	428	conhost.exe	76
PID 428 wrote to memory of 2736	428	conhost.exe	76
PID 428 wrote to memory of 4404	428	conhost.exe	79
PID 428 wrote to memory of 4404	428	conhost.exe	79
PID 428 wrote to memory of 4404	428	conhost.exe	79
PID 428 wrote to memory of 3948	428	conhost.exe	80
PID 428 wrote to memory of 3948	428	conhost.exe	80
PID 428 wrote to memory of 3948	428	conhost.exe	80
PID 3948 wrote to memory of 4208	3948	cmd.exe	83
PID 3948 wrote to memory of 4208	3948	cmd.exe	83
PID 3948 wrote to memory of 4208	3948	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\RBXFlox.exe
"C:\Users\Admin\AppData\Local\Temp\RBXFlox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Roaming\conhost.exe
    "C:\Users\Admin\AppData\Roaming\conhost.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2736
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe"
      4⤵
      Modifies Windows Firewall
      PID:4404
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /k ping 0 & del "C:\Users\Admin\AppData\Roaming\conhost.exe" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 0
        5⤵
        Runs ping.exe
        
        PID:4208

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\WatchUndo.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\svchost.exe
Size 37KB
SHA256 b85fdd5fad362079988a81ae2db8587da09d6c5e16d9c26094fb009392a56673
MD5 ba5483d6cca80b233354a7a32e75ec29
SHA1 7d43d0ffaf39eb2e49f515cbb976fb0b374e9501
SHA512 3c990a6d2315b5f59cd8a06b9d4171b7631e197a84af9608f32b7e8e516cb8a99d0041c159ab9bcb3b556f12f32626b2f06c198ca6b7312d86d79fb1143e5a75
SSDEEP 384:TYyCiM6B63fbw6ZfrZUy8fuO3J6gexiXArAF+rMRTyN/0L+EcoinblneHQM3epzu:0u0DwODZX8fuOMNiQrM+rMRa8Nurgt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4656-8-0x00000000725A1000-0x00000000725A2000-memory.dmp

Download

memory/4656-9-0x00000000725A0000-0x0000000072B50000-memory.dmp

Download

memory/4656-10-0x00000000725A0000-0x0000000072B50000-memory.dmp

Download

memory/4656-17-0x00000000725A0000-0x0000000072B50000-memory.dmp

Download