njrat | 857264595c877f796f23b52d6658a540eeb209dabac61a40b50b741e0a7a4cea

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

43KB
MD5

ae39bd7d279a8690138fa777f817e349
SHA1

392e252bd6e25a4503e912fe951cfdc82a3ff876
SHA256

857264595c877f796f23b52d6658a540eeb209dabac61a40b50b741e0a7a4cea
SHA512

bcdef31a0ca7fba3ed51eeb5aa753202de045016ea043b6f3357ae37ea6a6da742fdb3201ee0294b46987e76b212ed01d99998132215890ebfa4c66ff5e18016
SSDEEP

384:AZyLlQt+3qpyeKZdaJBEv8FIVsVGVuuAzQIij+ZsNO3PlpJKkkjh/TzF7pWnPA/l:m5wageMd+tF3uXQ/oB3+L

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

listing-trackbacks.gl.at.ply.gg:15337:8848

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2232	Server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe
Token: 33	2232	Server.exe
Token: SeIncBasePriorityPrivilege	2232	Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-0-0x00000000741CE000-0x00000000741CF000-memory.dmp

Filesize
4KB

Download
memory/2232-1-0x0000000000D60000-0x0000000000D72000-memory.dmp

Filesize
72KB

Download
memory/2232-2-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download
memory/2232-4-0x00000000741CE000-0x00000000741CF000-memory.dmp

Filesize
4KB

Download
memory/2232-5-0x00000000741C0000-0x00000000748AE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads