njrat | 2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe
Size

93KB
MD5

bc86b969a1c887c1d0bec9807bd59c20
SHA1

6145f1a5aa846d5592038b5018bff50f249ba6c7
SHA256

2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116
SHA512

0d8ba7e09704512dca244d03e7f3658d2562cdc8065996d0f31da772adbf65fe449a3a015f71fee73db79aa9cc786ed8c3a7fdc76d78f365af7352124c4fc443
SSDEEP

1536:+mzJD/HBZbszKu9AZpt7r1jEwzGi1dDLD6gS:+mSzK4AZHHCi1dT/

Score

10^/10

njrat sarcazm discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

sarcazm

hakim32.ddns.net:2000

disclaimer-establish.gl.at.ply.gg:45887

Mutex

6a5ef65cabb4f7e7f2ef0d8156f8282b

Attributes

reg_key
6a5ef65cabb4f7e7f2ef0d8156f8282b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1644	netsh.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6a5ef65cabb4f7e7f2ef0d8156f8282bWindows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6a5ef65cabb4f7e7f2ef0d8156f8282bWindows Update.exe	server.exe

Executes dropped EXE 1 IoCs

pid	Process
1872	server.exe

Loads dropped DLL 2 IoCs

pid	Process
2200	2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe
2200	2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Explower.exe	server.exe
File opened for modification	C:\Program Files (x86)\Explower.exe	server.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe
1872	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1872	server.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe
Token: 33	1872	server.exe
Token: SeIncBasePriorityPrivilege	1872	server.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1872	2200	2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe	30
PID 2200 wrote to memory of 1872	2200	2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe	30
PID 2200 wrote to memory of 1872	2200	2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe	30
PID 2200 wrote to memory of 1872	2200	2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe	30
PID 1872 wrote to memory of 1644	1872	server.exe	31
PID 1872 wrote to memory of 1644	1872	server.exe	31
PID 1872 wrote to memory of 1644	1872	server.exe	31
PID 1872 wrote to memory of 1644	1872	server.exe	31

C:\Users\Admin\AppData\Local\Temp\2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe
"C:\Users\Admin\AppData\Local\Temp\2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
53ce6d1ae8885b5d12e654469f456c83

SHA1
9d8b30c523ddef4d24134072b27716bec7d94d6f

SHA256
d7ebf92ad6e3bc44fbc3cfbb234ef4afafd7ea339f712229641a2849b6f87ce2

SHA512
c15df9281e9ccbb8d30e24e751b77a030e734f8cda4bd9482d3ca02f6b23e463a8e90ddd78a582ca059e57b8d0492c22583d792bc7368094ffc06e12cd145d9d

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
93KB

MD5
bc86b969a1c887c1d0bec9807bd59c20

SHA1
6145f1a5aa846d5592038b5018bff50f249ba6c7

SHA256
2303372dde201ee30cd17b7b33525e342d300d0dd10bf2922e1d68bcd5bec116

SHA512
0d8ba7e09704512dca244d03e7f3658d2562cdc8065996d0f31da772adbf65fe449a3a015f71fee73db79aa9cc786ed8c3a7fdc76d78f365af7352124c4fc443

Download Submit
memory/1872-15-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-16-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-30-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/2200-0-0x00000000749E1000-0x00000000749E2000-memory.dmp

Filesize
4KB

Download
memory/2200-2-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/2200-1-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/2200-14-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download