njrat | fc2631c62f5aadf52a4f83289493d04a5ab8a108d004eb6a55eacbf98df41f08

General

Target
BVSYd4tm.exe
Size 23KB
Sample240622-pgldfsxfrc
SHA256 fc2631c62f5aadf52a4f83289493d04a5ab8a108d004eb6a55eacbf98df41f08
MD5 bb7170cddabbe302e36414eb9ecae880
SHA1 6a1a0a3f40ff9b81c8e75436fc1465aaca719d63
SHA512 1132f0b9d71c6810314eb626ababe5dae936852e7bb78e35a8d81455226bc9689f2711dae9908bbfc4720b06c95a7d652990dc43884697d82d8ac950cfe98a1f
SSDEEP 384:oc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZkV6:ce9EJLN/yRpcnuG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

Disable or Modify System Firewall

pid	Process
1316	netsh.exe
772	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b3138e85921a1262aba82bcb6c7c507d.exe	BVSYd4tm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b3138e85921a1262aba82bcb6c7c507d.exe	BVSYd4tm.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b3138e85921a1262aba82bcb6c7c507d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BVSYd4tm.exe\" .."	BVSYd4tm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b3138e85921a1262aba82bcb6c7c507d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BVSYd4tm.exe\" .."	BVSYd4tm.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3220	PING.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	BVSYd4tm.exe
Token: 33	3840	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	3840	BVSYd4tm.exe
Token: 33	3840	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	3840	BVSYd4tm.exe
Token: 33	3840	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	3840	BVSYd4tm.exe
Token: 33	3840	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	3840	BVSYd4tm.exe
Token: 33	3840	BVSYd4tm.exe
Token: SeIncBasePriorityPrivilege	3840	BVSYd4tm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 1316	3840	BVSYd4tm.exe	90
PID 3840 wrote to memory of 1316	3840	BVSYd4tm.exe	90
PID 3840 wrote to memory of 1316	3840	BVSYd4tm.exe	90
PID 3840 wrote to memory of 772	3840	BVSYd4tm.exe	98
PID 3840 wrote to memory of 772	3840	BVSYd4tm.exe	98
PID 3840 wrote to memory of 772	3840	BVSYd4tm.exe	98
PID 3840 wrote to memory of 936	3840	BVSYd4tm.exe	99
PID 3840 wrote to memory of 936	3840	BVSYd4tm.exe	99
PID 3840 wrote to memory of 936	3840	BVSYd4tm.exe	99
PID 936 wrote to memory of 3220	936	cmd.exe	102
PID 936 wrote to memory of 3220	936	cmd.exe	102
PID 936 wrote to memory of 3220	936	cmd.exe	102