njrat | 857264595c877f796f23b52d6658a540eeb209dabac61a40b50b741e0a7a4cea

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

43KB
MD5

ae39bd7d279a8690138fa777f817e349
SHA1

392e252bd6e25a4503e912fe951cfdc82a3ff876
SHA256

857264595c877f796f23b52d6658a540eeb209dabac61a40b50b741e0a7a4cea
SHA512

bcdef31a0ca7fba3ed51eeb5aa753202de045016ea043b6f3357ae37ea6a6da742fdb3201ee0294b46987e76b212ed01d99998132215890ebfa4c66ff5e18016
SSDEEP

384:AZyLlQt+3qpyeKZdaJBEv8FIVsVGVuuAzQIij+ZsNO3PlpJKkkjh/TzF7pWnPA/l:m5wageMd+tF3uXQ/oB3+L

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

listing-trackbacks.gl.at.ply.gg:15337:8848

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1340	Server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe
Token: 33	1340	Server.exe
Token: SeIncBasePriorityPrivilege	1340	Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4420,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-0-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

Filesize
4KB

Download
memory/1340-1-0x0000000000A50000-0x0000000000A62000-memory.dmp

Filesize
72KB

Download
memory/1340-2-0x0000000005460000-0x00000000054FC000-memory.dmp

Filesize
624KB

Download
memory/1340-3-0x0000000005DB0000-0x0000000006354000-memory.dmp

Filesize
5.6MB

Download
memory/1340-4-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download
memory/1340-5-0x00000000058A0000-0x0000000005932000-memory.dmp

Filesize
584KB

Download
memory/1340-7-0x00000000055E0000-0x00000000055EA000-memory.dmp

Filesize
40KB

Download
memory/1340-8-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

Filesize
4KB

Download
memory/1340-9-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads