njrat | 536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1

Analysis

max time kernel
146s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 21:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe
Size

117KB
MD5

4e8d08bf55d6cf5004784e7e24f7c5f9
SHA1

7004e76d09c4c0cb33c91e68230715bb4a2db8a6
SHA256

536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1
SHA512

177e61c96fc18855a2c7f1451cc930cb81f8702f014460dd4cd02fce61af499dc0b4217744a5764afef047e0e5e8b75252cc82719057fea04ec8254b7a8dca05
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL5J:P5eznsjsguGDFqGZ2rDLz

Score

10^/10

njrat neuf evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2796	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
304	chargeable.exe
2920	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
1716	536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe
1716	536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe"	536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 304 set thread context of 2920	304	chargeable.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe
Token: 33	2920	chargeable.exe
Token: SeIncBasePriorityPrivilege	2920	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 304	1716	536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe	28
PID 1716 wrote to memory of 304	1716	536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe	28
PID 1716 wrote to memory of 304	1716	536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe	28
PID 1716 wrote to memory of 304	1716	536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe	28
PID 304 wrote to memory of 2920	304	chargeable.exe	29
PID 304 wrote to memory of 2920	304	chargeable.exe	29
PID 304 wrote to memory of 2920	304	chargeable.exe	29
PID 304 wrote to memory of 2920	304	chargeable.exe	29
PID 304 wrote to memory of 2920	304	chargeable.exe	29
PID 304 wrote to memory of 2920	304	chargeable.exe	29
PID 304 wrote to memory of 2920	304	chargeable.exe	29
PID 304 wrote to memory of 2920	304	chargeable.exe	29
PID 304 wrote to memory of 2920	304	chargeable.exe	29
PID 2920 wrote to memory of 2796	2920	chargeable.exe	30
PID 2920 wrote to memory of 2796	2920	chargeable.exe	30
PID 2920 wrote to memory of 2796	2920	chargeable.exe	30
PID 2920 wrote to memory of 2796	2920	chargeable.exe	30

C:\Users\Admin\AppData\Local\Temp\536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe
"C:\Users\Admin\AppData\Local\Temp\536ea76920062886038f5a468ce455392698eeccbfcd64c1a15702b4f943d4f1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:304
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956

Filesize
1KB

MD5
fc1193c6345ac35188aa3de0f824ceb7

SHA1
8fb5606f5380ac6ace7bb4e7c71b6750362e8c5f

SHA256
bdfb8faff4c0c0a15c642890a5544bd32f930f55ca199470dbd4736a32d6e200

SHA512
480a3ad52cf215db3cede6ad93293f8f031c2cb7a190c6f4cbcd0f3eb06f5c81c7f13d304a495945192e759ab5403245acef7be0149b8615ce2b194927f3dec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
732b1f8f4905938ee4754318f43d3807

SHA1
7b526a83ccf958c630a91c0552f5003512fb4ce1

SHA256
58f035bd451bf9f2e4bb4b801049db63a41a09d0709bd4676771476022c20764

SHA512
fbdfd28633dc6c89d21c9d4e6e8470df72b40a1122a0cbb0624453585a31710b9f6579068a02ab6286ea1dcc4339a8b8646819910f8827f7aa1f20aed0ad1c3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5b10ee2607e456f11959a04507c0339

SHA1
406eaa57d2e15598d61de0e85da6a5ef38179e82

SHA256
a25323ca9a24b703d2835eac241649e9d8a35ba61e57bfebf98fcbad6d0b16d8

SHA512
1bbc91e86fed63166f237d688ea2cdfed7805c7233443ad045cf9e45d96a293ec13009879c4ded32494959dadd4a1ab24657400b7680b585bfacd3d44bfc7e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2caa38617af875fa5b7c45bc5ed35773

SHA1
3c50617ed3fa886181d3680c7bde741af41c943d

SHA256
ce631d1e966dd5d677cb9c28553c50d1a3d750db2a690f7b59bb782f31b913d7

SHA512
864c16f40b8e9580473931ea9807c11e6e48c3e34cd6efb12f22d6a0b2a573acc9967af51d99fa74444d4f71fbcb1b84947ea683fcf73a89c3de3b9f31f788c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956

Filesize
252B

MD5
1e27e43472d0f2a8efb6bc5ed48a073d

SHA1
13d6a3f9fbca6d1f338b1b80aa13c09b013b8d71

SHA256
ab951219874cec678275b5873efaf0472e6d3749d903d4a75156ecbf252f5634

SHA512
7cc1994b29455f7c1c4822133c770bdb79121d17baffea7007669fc9e325a776c478730fc6c9a790658ea49ca260973ce0198539cb0a8a09e541230218b2efb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29E0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29F3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B92.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Filesize
117KB

MD5
0060a4d41525f2497c835aa27ccfb71b

SHA1
ebf3a7e44a981e7187a148559dbd042f602d92f6

SHA256
95d6a7b3e5ca58d7dd76e3d4737a13cf624692aac60e21ce3802c5a0b53df178

SHA512
d39e382cea60975bdc34399db17121883f96bd4c94144e2861a1523065661d469ee5423b0858fcbad43f0a1828bac30fc537afd8b631b443972a03151c22d9e2

Download Submit
memory/1716-193-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/1716-0-0x0000000074B61000-0x0000000074B62000-memory.dmp

Filesize
4KB

Download
memory/1716-1-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/1716-2-0x0000000074B60000-0x000000007510B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-361-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2920-364-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2920-363-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads