njrat | 9c70b6c97b2873e2e80a201f78bb4623e8e7b1836776722f968afb22987cff9d

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rATAT.exe
Size 93KB
Sample240726-sj9evayfnd
SHA256 9c70b6c97b2873e2e80a201f78bb4623e8e7b1836776722f968afb22987cff9d
MD5 aef03301e02b05d79e9c4d9c5e92155d
SHA1 746c39203a7b9b06126790019a8242f44a2a7c65
SHA512 9616f525673b822f01f17846cc63e47abbf7b953d9ba2a5e147a503918f01d172591d5b724c4166c4be2c575aab011d809b792b7fd70938d181a074935b6f6a5
SSDEEP 768:TY3jWpD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3WsGY:eWLOx6baIa9RIj00ljEwzGi1dDSDigS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

hakim32.ddns.net:2000
127.0.0.1:1488

Mutex

89d8ca52bf756a51823c18e77ba2eecc

Attributes

reg_key
89d8ca52bf756a51823c18e77ba2eecc
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2824	netsh.exe
2100	netsh.exe
2896	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe

Executes dropped EXE 1 IoCs

pid	Process
2336	server.exe

Loads dropped DLL 2 IoCs

pid	Process
1964	rATAT.exe
1964	rATAT.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	server.exe
File created	F:\autorun.inf	server.exe
File opened for modification	F:\autorun.inf	server.exe
File created	C:\autorun.inf	server.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Explower.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\Explower.exe	server.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Explower.exe	server.exe
File opened for modification	C:\Program Files (x86)\Explower.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rATAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe
2336	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe
Token: 33	2336	server.exe
Token: SeIncBasePriorityPrivilege	2336	server.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2336	1964	rATAT.exe	30
PID 1964 wrote to memory of 2336	1964	rATAT.exe	30
PID 1964 wrote to memory of 2336	1964	rATAT.exe	30
PID 1964 wrote to memory of 2336	1964	rATAT.exe	30
PID 2336 wrote to memory of 2100	2336	server.exe	31
PID 2336 wrote to memory of 2100	2336	server.exe	31
PID 2336 wrote to memory of 2100	2336	server.exe	31
PID 2336 wrote to memory of 2100	2336	server.exe	31
PID 2336 wrote to memory of 2896	2336	server.exe	33
PID 2336 wrote to memory of 2896	2336	server.exe	33
PID 2336 wrote to memory of 2896	2336	server.exe	33
PID 2336 wrote to memory of 2896	2336	server.exe	33
PID 2336 wrote to memory of 2824	2336	server.exe	34
PID 2336 wrote to memory of 2824	2336	server.exe	34
PID 2336 wrote to memory of 2824	2336	server.exe	34
PID 2336 wrote to memory of 2824	2336	server.exe	34

C:\Users\Admin\AppData\Local\Temp\rATAT.exe
"C:\Users\Admin\AppData\Local\Temp\rATAT.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2100
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2896
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app

Path C:\Users\Admin\AppData\Roaming\app
Size 5B
SHA256 538b830838cbf62e6ce267b48e2eb165030686e5b6317f0b1e9205a3e08c73b8
MD5 5014379cf5fa31db8a73d68d6353a145
SHA1 2a1a5138e8c9e7547caae1c9fb223afbf714ed00
SHA512 5091a16ef7730449601a70b5ef5512a93c98c76beb8cfee1adc9d39780c49b1d712e764720b04e44e18c7b08633c5d453793462c18dc6bef14d82bf69892e18f
MD5 SHA1 SHA512

Submit Download

server.exe

Path \Users\Admin\AppData\Local\Temp\server.exe
Size 93KB
SHA256 9c70b6c97b2873e2e80a201f78bb4623e8e7b1836776722f968afb22987cff9d
MD5 aef03301e02b05d79e9c4d9c5e92155d
SHA1 746c39203a7b9b06126790019a8242f44a2a7c65
SHA512 9616f525673b822f01f17846cc63e47abbf7b953d9ba2a5e147a503918f01d172591d5b724c4166c4be2c575aab011d809b792b7fd70938d181a074935b6f6a5
SSDEEP 768:TY3jWpD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3WsGY:eWLOx6baIa9RIj00ljEwzGi1dDSDigS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1964-0-0x0000000074051000-0x0000000074052000-memory.dmp

Download

memory/1964-1-0x0000000074050000-0x00000000745FB000-memory.dmp

Download

memory/1964-2-0x0000000074050000-0x00000000745FB000-memory.dmp

Download

memory/1964-14-0x0000000074050000-0x00000000745FB000-memory.dmp

Download

memory/2336-16-0x0000000074050000-0x00000000745FB000-memory.dmp

Download

memory/2336-15-0x0000000074050000-0x00000000745FB000-memory.dmp

Download

memory/2336-17-0x0000000074050000-0x00000000745FB000-memory.dmp

Download

memory/2336-37-0x0000000074050000-0x00000000745FB000-memory.dmp

Download