njrat | b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92

General

Target
b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92.exe
Size 37KB
Sample240613-cb5tpazfqg
SHA256 b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92
MD5 4b19f3492b1dcc10d22351a0e2e08020
SHA1 150ab0dd10e35734b038dceb71477336563dbb81
SHA512 7a06c79b59284b267eb0701de76e386b6c575092e8d95d910412167e558ba3a086d99d5969373bbb394e73020d00eeb5b493387ebf193d4cf90c3c953d84017d
SSDEEP 384:ZlmFnqi0lJZtbH9KyM+2VzmiPZMsWer5rAF+rMRTyN/0L+EcoinblneHQM3epzXU:DmSJ95M+2V6iqVe9rM+rMRa8NuMDt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

born-administrative.gl.at.ply.gg:10324

Mutex

c6aa749155b3480287d64e2d4a50cdbf

Attributes

reg_key
c6aa749155b3480287d64e2d4a50cdbf
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1288	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c6aa749155b3480287d64e2d4a50cdbf.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c6aa749155b3480287d64e2d4a50cdbf.exe	svhost.exe

Executes dropped EXE 1 IoCs

pid	Process
1068	svhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c6aa749155b3480287d64e2d4a50cdbf = "\"C:\\Windows\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c6aa749155b3480287d64e2d4a50cdbf = "\"C:\\Windows\\svhost.exe\" .."	svhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92.exe
File opened for modification	C:\Windows\svhost.exe	b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92.exe
File opened for modification	C:\Windows\svhost.exe	svhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe
Token: 33	1068	svhost.exe
Token: SeIncBasePriorityPrivilege	1068	svhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1068	1912	b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92.exe	85
PID 1912 wrote to memory of 1068	1912	b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92.exe	85
PID 1912 wrote to memory of 1068	1912	b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92.exe	85
PID 1068 wrote to memory of 1288	1068	svhost.exe	86
PID 1068 wrote to memory of 1288	1068	svhost.exe	86
PID 1068 wrote to memory of 1288	1068	svhost.exe	86

C:\Users\Admin\AppData\Local\Temp\b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92.exe
"C:\Users\Admin\AppData\Local\Temp\b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\svhost.exe" "svhost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svhost.exe

Path C:\Windows\svhost.exe
Size 37KB
SHA256 b7087b4779d76ca804a68f5f73e64a3e94c24fea7a1469f29860b372ca498f92
MD5 4b19f3492b1dcc10d22351a0e2e08020
SHA1 150ab0dd10e35734b038dceb71477336563dbb81
SHA512 7a06c79b59284b267eb0701de76e386b6c575092e8d95d910412167e558ba3a086d99d5969373bbb394e73020d00eeb5b493387ebf193d4cf90c3c953d84017d
SSDEEP 384:ZlmFnqi0lJZtbH9KyM+2VzmiPZMsWer5rAF+rMRTyN/0L+EcoinblneHQM3epzXU:DmSJ95M+2V6iqVe9rM+rMRa8NuMDt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-13-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/1068-15-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/1912-0-0x00000000754C2000-0x00000000754C3000-memory.dmp

Download

memory/1912-1-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/1912-2-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/1912-12-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads