njrat | 1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe
Size 110KB
Sample240613-x4cntsseqn
SHA256 1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3
MD5 cba9be12f091a122b56157492e5d978d
SHA1 4c86debe9a94ad3d0d3873ef929c6a15e7d7a406
SHA512 398dd5b0f4ae55abcd00bcaaf227cad82b913056caa809967d8cda784cf890985ef1cc501c1b6c1166986996d519f180ae7a65c402c7558727ba66ae0476b108
SSDEEP 1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73g:w5eznsjsguGDFqGx8egoxmO3rg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1636	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe

Executes dropped EXE 3 IoCs

pid	Process
1292	chargeable.exe
1580	chargeable.exe
2552	chargeable.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe"	1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 1580	1292	chargeable.exe	86
PID 1292 set thread context of 2552	1292	chargeable.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	2552	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe
Token: 33	1580	chargeable.exe
Token: SeIncBasePriorityPrivilege	1580	chargeable.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1292	1116	1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe	84
PID 1116 wrote to memory of 1292	1116	1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe	84
PID 1116 wrote to memory of 1292	1116	1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe	84
PID 1292 wrote to memory of 2552	1292	chargeable.exe	85
PID 1292 wrote to memory of 2552	1292	chargeable.exe	85
PID 1292 wrote to memory of 2552	1292	chargeable.exe	85
PID 1292 wrote to memory of 1580	1292	chargeable.exe	86
PID 1292 wrote to memory of 1580	1292	chargeable.exe	86
PID 1292 wrote to memory of 1580	1292	chargeable.exe	86
PID 1292 wrote to memory of 1580	1292	chargeable.exe	86
PID 1292 wrote to memory of 1580	1292	chargeable.exe	86
PID 1292 wrote to memory of 1580	1292	chargeable.exe	86
PID 1292 wrote to memory of 1580	1292	chargeable.exe	86
PID 1292 wrote to memory of 1580	1292	chargeable.exe	86
PID 1292 wrote to memory of 2552	1292	chargeable.exe	85
PID 1292 wrote to memory of 2552	1292	chargeable.exe	85
PID 1292 wrote to memory of 2552	1292	chargeable.exe	85
PID 1292 wrote to memory of 2552	1292	chargeable.exe	85
PID 1292 wrote to memory of 2552	1292	chargeable.exe	85
PID 1580 wrote to memory of 1636	1580	chargeable.exe	90
PID 1580 wrote to memory of 1636	1580	chargeable.exe	90
PID 1580 wrote to memory of 1636	1580	chargeable.exe	90

C:\Users\Admin\AppData\Local\Temp\1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe
"C:\Users\Admin\AppData\Local\Temp\1098990bd4dbd45e13105ff7ea99e63d6bcaf45900936829c6a68036466549f3.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    PID:2552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 80
      4⤵
      Program crash
      PID:1376
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2552 -ip 2552
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chargeable.exe

Path C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
Size 110KB
SHA256 b75be02153d45ef31047718e958be3c5a310edc9fe07da4fc370f785e55f79f4
MD5 e6b58c14523e78db84b5f82ce61a64fc
SHA1 26bfb34aca80c75dcbe2fff798eea802d5dd2423
SHA512 91df380c7bc19f0b5c9fc0628364daa477df9fdb2269b4b4b5caf07c7b36cb9e890fb888825f4401bfd0b1928a89f5d9d69173ae3dc56f38cfcc71eb07abc829
SSDEEP 1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73t:w5eznsjsguGDFqGx8egoxmO3rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1116-0-0x0000000074D72000-0x0000000074D73000-memory.dmp

Download

memory/1116-1-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1116-2-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1116-17-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1292-19-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1292-18-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1292-20-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1292-27-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1580-21-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1580-26-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1580-29-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1580-28-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

memory/1580-30-0x0000000074D70000-0x0000000075321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads