njrat | c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69

Analysis

max time kernel
127s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
201ec2f7b087e3ca36f271b35c662d3c.exe
Size 14.8MB
Sample240725-cfkdjs1hlm
SHA256 c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69
MD5 201ec2f7b087e3ca36f271b35c662d3c
SHA1 99f1146550f28dd1828ccf2962df1b8182d6d8a6
SHA512 d52e7364e1bfb8c0e828ae96bcba3c5a2d783d36a13e5113973db2e70a34ca9258d298bc44ac8cde024573fa34ef225804759745650f11019708277642cdffe2
SSDEEP 196608:OuoDktaVNHIoS9C4kNir2yv7wPWpGplR806IIIIIIIIIIIIIIIIIIIIIIIIIIII2:OuiKaVNHIoS9Cx1yvkPWpGplR8ZW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat vpn55 discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

vpn55

147.185.221.21:11656

Mutex

dbff472320d89464fd01ee82ecd1dabe

Attributes

reg_key
dbff472320d89464fd01ee82ecd1dabe
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3180	netsh.exe
4788	netsh.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x000a0000000234aa-15.dat	net_reactor

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	201ec2f7b087e3ca36f271b35c662d3c.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe	steam.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbff472320d89464fd01ee82ecd1dabe.exe	steam.exe

Executes dropped EXE 1 IoCs

pid	Process
3096	steam.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dbff472320d89464fd01ee82ecd1dabe = "\"C:\\Users\\Admin\\AppData\\Roaming\\steam.exe\" .."	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dbff472320d89464fd01ee82ecd1dabe = "\"C:\\Users\\Admin\\AppData\\Roaming\\steam.exe\" .."	steam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3844	PING.EXE
4600	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3844	PING.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	steam.exe
Token: 33	3096	steam.exe
Token: SeIncBasePriorityPrivilege	3096	steam.exe
Token: 33	3096	steam.exe
Token: SeIncBasePriorityPrivilege	3096	steam.exe
Token: 33	3096	steam.exe
Token: SeIncBasePriorityPrivilege	3096	steam.exe
Token: 33	3096	steam.exe
Token: SeIncBasePriorityPrivilege	3096	steam.exe
Token: 33	3096	steam.exe
Token: SeIncBasePriorityPrivilege	3096	steam.exe
Token: 33	3096	steam.exe
Token: SeIncBasePriorityPrivilege	3096	steam.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3096	4760	201ec2f7b087e3ca36f271b35c662d3c.exe	93
PID 4760 wrote to memory of 3096	4760	201ec2f7b087e3ca36f271b35c662d3c.exe	93
PID 3096 wrote to memory of 3180	3096	steam.exe	95
PID 3096 wrote to memory of 3180	3096	steam.exe	95
PID 3096 wrote to memory of 4788	3096	steam.exe	101
PID 3096 wrote to memory of 4788	3096	steam.exe	101
PID 3096 wrote to memory of 4600	3096	steam.exe	102
PID 3096 wrote to memory of 4600	3096	steam.exe	102
PID 4600 wrote to memory of 3844	4600	cmd.exe	105
PID 4600 wrote to memory of 3844	4600	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\201ec2f7b087e3ca36f271b35c662d3c.exe
"C:\Users\Admin\AppData\Local\Temp\201ec2f7b087e3ca36f271b35c662d3c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Roaming\steam.exe
  "C:\Users\Admin\AppData\Roaming\steam.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SYSTEM32\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\steam.exe" "steam.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3180
- - C:\Windows\SYSTEM32\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\steam.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4788
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Roaming\steam.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\system32\PING.EXE
      ping 0 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

steam.exe

Path C:\Users\Admin\AppData\Roaming\steam.exe
Size 14.8MB
SHA256 c004adf9200f82a0154cf424036e25256e2c4478ed3cf38a245fa10b3b002f69
MD5 201ec2f7b087e3ca36f271b35c662d3c
SHA1 99f1146550f28dd1828ccf2962df1b8182d6d8a6
SHA512 d52e7364e1bfb8c0e828ae96bcba3c5a2d783d36a13e5113973db2e70a34ca9258d298bc44ac8cde024573fa34ef225804759745650f11019708277642cdffe2
SSDEEP 196608:OuoDktaVNHIoS9C4kNir2yv7wPWpGplR806IIIIIIIIIIIIIIIIIIIIIIIIIIII2:OuiKaVNHIoS9Cx1yvkPWpGplR8ZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3096-23-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/3096-38-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/3096-34-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/3096-33-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/3096-32-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/3096-31-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/3096-30-0x000000001DA80000-0x000000001DAE2000-memory.dmp

Download

memory/3096-28-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/3096-27-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/3096-25-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/3096-26-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/4760-6-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Download

memory/4760-24-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/4760-10-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/4760-9-0x000000001C650000-0x000000001C65C000-memory.dmp

Download

memory/4760-8-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/4760-7-0x000000001C770000-0x000000001C7BC000-memory.dmp

Download

memory/4760-0-0x00007FF896D95000-0x00007FF896D96000-memory.dmp

Download

memory/4760-5-0x000000001C5A0000-0x000000001C63C000-memory.dmp

Download

memory/4760-4-0x000000001C0D0000-0x000000001C59E000-memory.dmp

Download

memory/4760-3-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

memory/4760-2-0x0000000001ED0000-0x0000000001F76000-memory.dmp

Download

memory/4760-1-0x00007FF896AE0000-0x00007FF897481000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads