njrat | a5ef976d928a096d7e298343b16ba54632411dc7fcb97f93e229ea24702578db

General

Target

GangBeasts.exe
Size

7.6MB
MD5

25ca0c07fa5e3b2fc1a30e5419a13c17
SHA1

0231b575d2f96de4a9f510b081e5f519c5bafabd
SHA256

a5ef976d928a096d7e298343b16ba54632411dc7fcb97f93e229ea24702578db
SHA512

d7d87ab9dd41c97289f94dfeb6141972c101942a0a466c5f1eda581b5ef81c5c9666bbd518bcb6db80d5ccbbc03db27c55a53cd1fd10845d89d49391d9bf91ab
SSDEEP

196608:n0+R+YMhI/tizvNSE28tpobqjglbxvb65j0iQtgcN+QiP1eggYej0WALg:n0+R+YMhI/tizvN88tpo28lFvWp0i2Zv

Score

10^/10

njrat kosomk 555 discovery evasion persistence privilege_escalation trojan upx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

kosomk 555

C2

dovelabobzgnan.ddns.net:5552

Mutex

a8c0d4cf5cfc2cc1149b5e071c2ab5df

Attributes

reg_key
a8c0d4cf5cfc2cc1149b5e071c2ab5df
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2424	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8c0d4cf5cfc2cc1149b5e071c2ab5df.exe	dicsord.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8c0d4cf5cfc2cc1149b5e071c2ab5df.exe	dicsord.exe

Executes dropped EXE 6 IoCs

pid	Process
1892	Gang Beasts.exe
2384	kosomk.exe
1808	Built.exe
2812	Built.exe
2816	dicsord.exe
1200	Process not Found

Loads dropped DLL 6 IoCs

pid	Process
1252	GangBeasts.exe
1252	GangBeasts.exe
1252	GangBeasts.exe
1808	Built.exe
2812	Built.exe
2384	kosomk.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000018bc8-44.dat	upx
behavioral1/memory/2812-46-0x000007FEF6140000-0x000007FEF672E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\a8c0d4cf5cfc2cc1149b5e071c2ab5df = "\"C:\\Users\\Admin\\AppData\\Roaming\\dicsord.exe\" .."	dicsord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\a8c0d4cf5cfc2cc1149b5e071c2ab5df = "\"C:\\Users\\Admin\\AppData\\Roaming\\dicsord.exe\" .."	dicsord.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GangBeasts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kosomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dicsord.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe
Token: 33	2816	dicsord.exe
Token: SeIncBasePriorityPrivilege	2816	dicsord.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1892	1252	GangBeasts.exe	30
PID 1252 wrote to memory of 1892	1252	GangBeasts.exe	30
PID 1252 wrote to memory of 1892	1252	GangBeasts.exe	30
PID 1252 wrote to memory of 1892	1252	GangBeasts.exe	30
PID 1252 wrote to memory of 2384	1252	GangBeasts.exe	31
PID 1252 wrote to memory of 2384	1252	GangBeasts.exe	31
PID 1252 wrote to memory of 2384	1252	GangBeasts.exe	31
PID 1252 wrote to memory of 2384	1252	GangBeasts.exe	31
PID 1252 wrote to memory of 1808	1252	GangBeasts.exe	32
PID 1252 wrote to memory of 1808	1252	GangBeasts.exe	32
PID 1252 wrote to memory of 1808	1252	GangBeasts.exe	32
PID 1252 wrote to memory of 1808	1252	GangBeasts.exe	32
PID 1808 wrote to memory of 2812	1808	Built.exe	33
PID 1808 wrote to memory of 2812	1808	Built.exe	33
PID 1808 wrote to memory of 2812	1808	Built.exe	33
PID 2384 wrote to memory of 2816	2384	kosomk.exe	34
PID 2384 wrote to memory of 2816	2384	kosomk.exe	34
PID 2384 wrote to memory of 2816	2384	kosomk.exe	34
PID 2384 wrote to memory of 2816	2384	kosomk.exe	34
PID 2816 wrote to memory of 2424	2816	dicsord.exe	36
PID 2816 wrote to memory of 2424	2816	dicsord.exe	36
PID 2816 wrote to memory of 2424	2816	dicsord.exe	36
PID 2816 wrote to memory of 2424	2816	dicsord.exe	36

C:\Users\Admin\AppData\Local\Temp\GangBeasts.exe
"C:\Users\Admin\AppData\Local\Temp\GangBeasts.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\Gang Beasts.exe
  "C:\Users\Admin\AppData\Local\Temp\Gang Beasts.exe"
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\kosomk.exe
  "C:\Users\Admin\AppData\Local\Temp\kosomk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Roaming\dicsord.exe
    "C:\Users\Admin\AppData\Roaming\dicsord.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\dicsord.exe" "dicsord.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2424
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI18082\python311.dll

Filesize
1.6MB

MD5
76eb1ad615ba6600ce747bf1acde6679

SHA1
d3e1318077217372653be3947635b93df68156a4

SHA256
30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

SHA512
2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

Download Submit
\Users\Admin\AppData\Local\Temp\Built.exe

Filesize
7.4MB

MD5
5531aaf254a3ef858aa2808a87e6c3c0

SHA1
18a8a22cfa4f987dddef5ce39b2a6118ec32a196

SHA256
45567c82cc7277f5aa2cb693f6abfa0c0b91d2a472e91fe0643e17dab855d3a8

SHA512
2e880257c6da44836a19b2d8f7a47ea1d21d94b50eb61543f5b9478e274343d7367ccd3c62c645861c03089550c85fdd92df61dd94bd79381757521a9ea45d68

Download Submit
\Users\Admin\AppData\Local\Temp\Gang Beasts.exe

Filesize
638KB

MD5
23d2ae54e204abdee7c3477a0eeaa93f

SHA1
99148c265a4b419855e4720ac802483b12568227

SHA256
621740b8a66c1b2432354dfbe2963c88902bca33d871ec919ad56470aff55d19

SHA512
d870ce4d6746675ef804a4a42177f664b54991ba6ea2c4ec751285d5a2b83479ed3f1c674913e8ff6f37099fa2c393848a878689dc25f333b2d27f2cc70c5568

Download Submit
\Users\Admin\AppData\Local\Temp\kosomk.exe

Filesize
23KB

MD5
926e2c78bcea51e5309db037b18b4202

SHA1
d4b80f95bfdc9c2ff860ac0cc2012a81b425801d

SHA256
1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10

SHA512
6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1

Download Submit
memory/2384-22-0x0000000074961000-0x0000000074962000-memory.dmp

Filesize
4KB

Download
memory/2384-42-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/2384-41-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/2384-54-0x0000000074960000-0x0000000074F0B000-memory.dmp

Filesize
5.7MB

Download
memory/2812-46-0x000007FEF6140000-0x000007FEF672E000-memory.dmp

Filesize
5.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads