Overview

overview

10

Static

static

3

News.exe

windows7-x64

10

News.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    News.Exe

  • Size

    73KB

  • Sample

    240725-zepcfawfrb

  • MD5

    be488e5157902bc9d0b920863d4405e9

  • SHA1

    c7fcb865c0591a3b095a6384a189882144d7dfe6

  • SHA256

    7376d155a75df53c85fbea9d9576e1cb004352102c7266c0f0b8ef60f60c8a25

  • SHA512

    f0a2caaa72d35b2faaa36e7347f3b46c545ea0bdcaf7589bb6af72d0df1cecab2bd7d2bbe5d1cad87fa36d9d39e8a17df4ffd472f680a47dc4373a0c817bdb9a

  • SSDEEP

    1536:MhJq9QuBn6bcNr6KcHwRc3lbVbxKrUM3+6tkhE39pWIEHyv5JXH3W+DqVqHGKEY1:MW9QuBnYZIrTV+WtpPE4V3W+eVqHWYyY

Score
10/10
njratvictimdiscoveryexecutionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

Victim

C2

kgb963.duckdns.org:1118

Mutex

svchost.exe

Attributes
  • reg_key

    svchost.exe

  • splitter

    |Ghost|

Targets

    • Target

      News.Exe

    • Size

      73KB

    • MD5

      be488e5157902bc9d0b920863d4405e9

    • SHA1

      c7fcb865c0591a3b095a6384a189882144d7dfe6

    • SHA256

      7376d155a75df53c85fbea9d9576e1cb004352102c7266c0f0b8ef60f60c8a25

    • SHA512

      f0a2caaa72d35b2faaa36e7347f3b46c545ea0bdcaf7589bb6af72d0df1cecab2bd7d2bbe5d1cad87fa36d9d39e8a17df4ffd472f680a47dc4373a0c817bdb9a

    • SSDEEP

      1536:MhJq9QuBn6bcNr6KcHwRc3lbVbxKrUM3+6tkhE39pWIEHyv5JXH3W+DqVqHGKEY1:MW9QuBnYZIrTV+WtpPE4V3W+eVqHWYyY

    Score
    10/10
    njratvictimdiscoveryexecutionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks