njrat | fc2631c62f5aadf52a4f83289493d04a5ab8a108d004eb6a55eacbf98df41f08

General

Target
BVSYd4tm.exe
Size 23KB
Sample240622-pgldfsxfrc
SHA256 fc2631c62f5aadf52a4f83289493d04a5ab8a108d004eb6a55eacbf98df41f08
MD5 bb7170cddabbe302e36414eb9ecae880
SHA1 6a1a0a3f40ff9b81c8e75436fc1465aaca719d63
SHA512 1132f0b9d71c6810314eb626ababe5dae936852e7bb78e35a8d81455226bc9689f2711dae9908bbfc4720b06c95a7d652990dc43884697d82d8ac950cfe98a1f
SSDEEP 384:oc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZkV6:ce9EJLN/yRpcnuG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

Disable or Modify System Firewall

pid	Process
2944	netsh.exe
1976	netsh.exe

Deletes itself 1 IoCs

pid	Process
1512	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b3138e85921a1262aba82bcb6c7c507d.exe	BVSYd4tm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b3138e85921a1262aba82bcb6c7c507d.exe	BVSYd4tm.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b3138e85921a1262aba82bcb6c7c507d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BVSYd4tm.exe\" .."	BVSYd4tm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\b3138e85921a1262aba82bcb6c7c507d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BVSYd4tm.exe\" .."	BVSYd4tm.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1252	PING.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	BVSYd4tm.exe
Token: 33	1804	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	1804	BVSYd4tm.exe
Token: 33	1804	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	1804	BVSYd4tm.exe
Token: 33	1804	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	1804	BVSYd4tm.exe
Token: 33	1804	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	1804	BVSYd4tm.exe
Token: 33	1804	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	1804	BVSYd4tm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2944	1804	BVSYd4tm.exe	28
PID 1804 wrote to memory of 2944	1804	BVSYd4tm.exe	28
PID 1804 wrote to memory of 2944	1804	BVSYd4tm.exe	28
PID 1804 wrote to memory of 2944	1804	BVSYd4tm.exe	28
PID 1804 wrote to memory of 1976	1804	BVSYd4tm.exe	33
PID 1804 wrote to memory of 1976	1804	BVSYd4tm.exe	33
PID 1804 wrote to memory of 1976	1804	BVSYd4tm.exe	33
PID 1804 wrote to memory of 1976	1804	BVSYd4tm.exe	33
PID 1804 wrote to memory of 1512	1804	BVSYd4tm.exe	34
PID 1804 wrote to memory of 1512	1804	BVSYd4tm.exe	34
PID 1804 wrote to memory of 1512	1804	BVSYd4tm.exe	34
PID 1804 wrote to memory of 1512	1804	BVSYd4tm.exe	34
PID 1512 wrote to memory of 1252	1512	cmd.exe	37
PID 1512 wrote to memory of 1252	1512	cmd.exe	37
PID 1512 wrote to memory of 1252	1512	cmd.exe	37
PID 1512 wrote to memory of 1252	1512	cmd.exe	37