njrat | a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe
Size

117KB
MD5

3f67a85bc93052e8818a0d67f14f8109
SHA1

6ef0bd5d82a5af43964626c7feccea2aaadd60ec
SHA256

a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b
SHA512

625676d2e804876d25c04718bd8f22ad15d4e7d16175b787c3e6ff102f690551f198f5e143ec5e80c7689eacf6b0b750c8e7bdad93fa07c9ee6498293c5398a1
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMIYAJ:P5eznsjsguGDFqGZ2rIY8

Score

10^/10

njrat neuf discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2056	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
2000	chargeable.exe
2788	chargeable.exe
2924	chargeable.exe
3044	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
2156	a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe
2156	a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe"	a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 2924	2000	chargeable.exe	33
PID 2000 set thread context of 2788	2000	chargeable.exe	32
PID 2000 set thread context of 3044	2000	chargeable.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe
Token: 33	2924	chargeable.exe
Token: SeIncBasePriorityPrivilege	2924	chargeable.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2000	2156	a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe	30
PID 2156 wrote to memory of 2000	2156	a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe	30
PID 2156 wrote to memory of 2000	2156	a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe	30
PID 2156 wrote to memory of 2000	2156	a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe	30
PID 2000 wrote to memory of 3044	2000	chargeable.exe	31
PID 2000 wrote to memory of 3044	2000	chargeable.exe	31
PID 2000 wrote to memory of 3044	2000	chargeable.exe	31
PID 2000 wrote to memory of 3044	2000	chargeable.exe	31
PID 2000 wrote to memory of 2788	2000	chargeable.exe	32
PID 2000 wrote to memory of 2788	2000	chargeable.exe	32
PID 2000 wrote to memory of 2788	2000	chargeable.exe	32
PID 2000 wrote to memory of 2788	2000	chargeable.exe	32
PID 2000 wrote to memory of 2924	2000	chargeable.exe	33
PID 2000 wrote to memory of 2924	2000	chargeable.exe	33
PID 2000 wrote to memory of 2924	2000	chargeable.exe	33
PID 2000 wrote to memory of 2924	2000	chargeable.exe	33
PID 2000 wrote to memory of 2924	2000	chargeable.exe	33
PID 2000 wrote to memory of 2924	2000	chargeable.exe	33
PID 2000 wrote to memory of 2924	2000	chargeable.exe	33
PID 2000 wrote to memory of 2924	2000	chargeable.exe	33
PID 2000 wrote to memory of 2924	2000	chargeable.exe	33
PID 2000 wrote to memory of 2788	2000	chargeable.exe	32
PID 2000 wrote to memory of 2788	2000	chargeable.exe	32
PID 2000 wrote to memory of 2788	2000	chargeable.exe	32
PID 2000 wrote to memory of 2788	2000	chargeable.exe	32
PID 2000 wrote to memory of 2788	2000	chargeable.exe	32
PID 2000 wrote to memory of 3044	2000	chargeable.exe	31
PID 2000 wrote to memory of 3044	2000	chargeable.exe	31
PID 2000 wrote to memory of 3044	2000	chargeable.exe	31
PID 2000 wrote to memory of 3044	2000	chargeable.exe	31
PID 2000 wrote to memory of 3044	2000	chargeable.exe	31
PID 2924 wrote to memory of 2056	2924	chargeable.exe	35
PID 2924 wrote to memory of 2056	2924	chargeable.exe	35
PID 2924 wrote to memory of 2056	2924	chargeable.exe	35
PID 2924 wrote to memory of 2056	2924	chargeable.exe	35

C:\Users\Admin\AppData\Local\Temp\a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe
"C:\Users\Admin\AppData\Local\Temp\a4536d89825433a01f2828cb9bef202df0caf3669efc55ac7fa6370b3d87411b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    PID:3044
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    PID:2788
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8db4ce9176448ebdfd72b92f6f48b0ce

SHA1
c7d7ef6b7d66428a181425542f7aed7d7dfc1caa

SHA256
eca1e1105fb25b98db71fba1cbcbeae35fbdeb2199f3223027006fcf701c3783

SHA512
50131d8a2ef3ee83ebb3b088705805cc675b56263f08baaafe1e95b993185ee27265d438b91c618168fd6a8719f1cba10705e95dae15929f5816908ecfc1c3f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d77fd8a01cc095573b65d9b5b4ad3fda

SHA1
366fc62dc6109686db2e0e80e3bc6b793a67c482

SHA256
e7cdee9e352dd7d1d5e4c74de9956d6f5871dcbb3676e893c2d4ed783fc1a654

SHA512
1c8d7bf993b85822be16e617aab4da299646d5f5ff1623fa09686c90b3cc523deb1db8e93957758802f219a44d07a8b4776b2dcf71e1273346385e8726528ab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7985e6670237a613583e5a2a31483617

SHA1
bebff188d8b25c71e624d404b1c0659c55ae7a39

SHA256
d5507a021f074301980b393e31116ca93c4691e180d2c044bdf6a4f403c76e37

SHA512
503a2f0683bfae73992957553bdf2a515e960d77c80e98ef3de0d24071e160260a79309e21260303391826eef638df1cf153d4652b29fb0ef6cd741c8f75e489

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab911B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar913D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Filesize
117KB

MD5
b8be1e79075a8ddaf966832bcb379274

SHA1
5408ea60b49f2e69c62fa332bfe7311b0b684296

SHA256
0af0c832787cd9a25f91d0593682ae328841f5c117559bff6d6e033117b3cc7d

SHA512
c8199b61e14b03025a9079455240d692d23a9a26c7ec844762ba77b02f874a3e16d45f68d7ddc9f2f8046affa9a2ea8b0c83b8f71be2f184546ac2ff8b717b4c

Download Submit
memory/2156-0-0x0000000074AB1000-0x0000000074AB2000-memory.dmp

Filesize
4KB

Download
memory/2156-164-0x0000000074AB0000-0x000000007505B000-memory.dmp

Filesize
5.7MB

Download
memory/2156-174-0x0000000074AB0000-0x000000007505B000-memory.dmp

Filesize
5.7MB

Download
memory/2156-2-0x0000000074AB0000-0x000000007505B000-memory.dmp

Filesize
5.7MB

Download
memory/2156-1-0x0000000074AB0000-0x000000007505B000-memory.dmp

Filesize
5.7MB

Download
memory/2924-338-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2924-344-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2924-345-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads