njrat | da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
18/06/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6cdaf6aa7bca7b33b37345ddd48e8e8c.exe
Size 114KB
Sample240618-g67c8a1cnc
SHA256 da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f
MD5 6cdaf6aa7bca7b33b37345ddd48e8e8c
SHA1 754aabcba09611a16c978041a98e2359772b6188
SHA512 9e1bdfc39ed820531122e66254e1f638941b93db4e79c854440e5423a11759f45513db9c22828eb029c5c27bc9f3394fc32c6e52c788bf89fcc2745c28b841c7
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDS+:P5eznsjsguGDFqGZ2rD5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2636	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2192	chargeable.exe
1660	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
2216	6cdaf6aa7bca7b33b37345ddd48e8e8c.exe
2216	6cdaf6aa7bca7b33b37345ddd48e8e8c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	6cdaf6aa7bca7b33b37345ddd48e8e8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6cdaf6aa7bca7b33b37345ddd48e8e8c.exe"	6cdaf6aa7bca7b33b37345ddd48e8e8c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2192 set thread context of 1660	2192	chargeable.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe
Token: 33	1660	chargeable.exe
Token: SeIncBasePriorityPrivilege	1660	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2192	2216	6cdaf6aa7bca7b33b37345ddd48e8e8c.exe	28
PID 2216 wrote to memory of 2192	2216	6cdaf6aa7bca7b33b37345ddd48e8e8c.exe	28
PID 2216 wrote to memory of 2192	2216	6cdaf6aa7bca7b33b37345ddd48e8e8c.exe	28
PID 2216 wrote to memory of 2192	2216	6cdaf6aa7bca7b33b37345ddd48e8e8c.exe	28
PID 2192 wrote to memory of 1660	2192	chargeable.exe	29
PID 2192 wrote to memory of 1660	2192	chargeable.exe	29
PID 2192 wrote to memory of 1660	2192	chargeable.exe	29
PID 2192 wrote to memory of 1660	2192	chargeable.exe	29
PID 2192 wrote to memory of 1660	2192	chargeable.exe	29
PID 2192 wrote to memory of 1660	2192	chargeable.exe	29
PID 2192 wrote to memory of 1660	2192	chargeable.exe	29
PID 2192 wrote to memory of 1660	2192	chargeable.exe	29
PID 2192 wrote to memory of 1660	2192	chargeable.exe	29
PID 1660 wrote to memory of 2636	1660	chargeable.exe	32
PID 1660 wrote to memory of 2636	1660	chargeable.exe	32
PID 1660 wrote to memory of 2636	1660	chargeable.exe	32
PID 1660 wrote to memory of 2636	1660	chargeable.exe	32

C:\Users\Admin\AppData\Local\Temp\6cdaf6aa7bca7b33b37345ddd48e8e8c.exe
"C:\Users\Admin\AppData\Local\Temp\6cdaf6aa7bca7b33b37345ddd48e8e8c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 dc961f8d9213d48ff3e2637384d7e0404a18f1a01cb39f499d54e486d4068930
MD5 911a35bd46b829ae052707c5ea5464c7
SHA1 fae518f0787886051bcbef41c61b827fe6312e89
SHA512 eae1ee97b3edfda0967c0c7edb741158d64640dff0ef0373b1d62cdf9b65e598fe2c53d3b00d474ff7a094aa4c68520cbebad7ec7016ab43863b73aadb9f89df
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 0fc5836690cd4f26e46411de7798ba480b2bac09bb4d642956f4814f133a7566
MD5 27c03670212c3971ed8b4ca1f95dcf98
SHA1 4ba4e273e255f43efcbf5bc97a6648aaf5b786b3
SHA512 43f7a0de65382179ff5707a045e8012497967bd9f97eea3aaaec77669b0ed68f46325177115eca414608da68a18e81735fbf9f68cb5941954df0e41f6d41667b
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 57fdbf40e4eb65440adc51af29de2f6b64a6c16bb4a5601f3b7649912319194b
MD5 4a68e30314d24154f341df822500b869
SHA1 cbf6f35141068ef79a4e4338dcb410a43e9b8148
SHA512 1da2a1560ea8610c2b52e5c5d899b91b8c140d19c9ed7281edf8f779a9acaed6a8aabc59604c910662a12f36a94312fed317c0ab3f29f118bc381291e85d301b
MD5 SHA1 SHA512

Submit Download

Cab9629.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab9629.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar964C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar964C.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

chargeable.exe

Path C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
Size 114KB
SHA256 3acec68b5747a5fce4923c51cb9873fe08878d92c82bb9a7915c4d5adf9bac4b
MD5 eee0a1093991054a641321bf90d113c3
SHA1 5eb7d50a7b9ab5491a803faa1f50f739bde8da1d
SHA512 f99cb0fd8a98a0bf740a358ce039039b80460fe49f4e22c6dd70b5464a4499db15c64b2555f677e0538cb95c254983e033e556352c5bc78ae56efc659bc1c9a3
SSDEEP 1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDSh:P5eznsjsguGDFqGZ2rDy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1660-341-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1660-344-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1660-343-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2216-0-0x0000000074301000-0x0000000074302000-memory.dmp

Download

memory/2216-177-0x0000000074300000-0x00000000748AB000-memory.dmp

Download

memory/2216-2-0x0000000074300000-0x00000000748AB000-memory.dmp

Download

memory/2216-1-0x0000000074300000-0x00000000748AB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads