njrat | 02b52a8fe7b171f01ed0d92a710e05d679cfdadb5af5ec00d0d2287113845425

General

Target

02b52a8fe7b171f01ed0d92a710e05d679cfdadb5af5ec00d0d2287113845425N.exe
Size

71KB
MD5

9bc6da63746a8734e52630d4acc16b70
SHA1

ec4ae894687a1eccdbc1f49e65ecc8111490bfdb
SHA256

02b52a8fe7b171f01ed0d92a710e05d679cfdadb5af5ec00d0d2287113845425
SHA512

656ee80aaaf746f95183c61c9818adf27d3f7ee7dd731d44324dbe8a9ac7340f12f224326c6a0614dc16120d3fa7335ea50c16394d2baa2b0f77bfdb5e9ccb20
SSDEEP

1536:TMPCNW3/a6vh/WYQXa2t8q9Uk3HdlKY8i5xZJnaKghlWZ1DyAP:T2i6p/W+e939qyha5DWZ1Dyc

Score

10^/10

njrat hacked by van evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed by van

C2

devilboydevilhere.strangled.net:5552

Mutex

4fe01d78ee168446922dd4aa533f849b

Attributes

reg_key
4fe01d78ee168446922dd4aa533f849b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2240	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2012	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4fe01d78ee168446922dd4aa533f849b = "\"C:\\Users\\Admin\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\4fe01d78ee168446922dd4aa533f849b = "\"C:\\Users\\Admin\\svchost.exe\" .."	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe
Token: 33	2012	svchost.exe
Token: SeIncBasePriorityPrivilege	2012	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2012	2348	02b52a8fe7b171f01ed0d92a710e05d679cfdadb5af5ec00d0d2287113845425N.exe	31
PID 2348 wrote to memory of 2012	2348	02b52a8fe7b171f01ed0d92a710e05d679cfdadb5af5ec00d0d2287113845425N.exe	31
PID 2348 wrote to memory of 2012	2348	02b52a8fe7b171f01ed0d92a710e05d679cfdadb5af5ec00d0d2287113845425N.exe	31
PID 2012 wrote to memory of 2240	2012	svchost.exe	32
PID 2012 wrote to memory of 2240	2012	svchost.exe	32
PID 2012 wrote to memory of 2240	2012	svchost.exe	32

C:\Users\Admin\AppData\Local\Temp\02b52a8fe7b171f01ed0d92a710e05d679cfdadb5af5ec00d0d2287113845425N.exe
"C:\Users\Admin\AppData\Local\Temp\02b52a8fe7b171f01ed0d92a710e05d679cfdadb5af5ec00d0d2287113845425N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\svchost.exe
  "C:\Users\Admin\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\system32\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\svchost.exe" "svchost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\svchost.exe

Filesize
71KB

MD5
9bc6da63746a8734e52630d4acc16b70

SHA1
ec4ae894687a1eccdbc1f49e65ecc8111490bfdb

SHA256
02b52a8fe7b171f01ed0d92a710e05d679cfdadb5af5ec00d0d2287113845425

SHA512
656ee80aaaf746f95183c61c9818adf27d3f7ee7dd731d44324dbe8a9ac7340f12f224326c6a0614dc16120d3fa7335ea50c16394d2baa2b0f77bfdb5e9ccb20

Download Submit
memory/2012-8-0x0000000000A40000-0x0000000000A58000-memory.dmp

Filesize
96KB

Download
memory/2012-9-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2012-10-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2012-11-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2012-12-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2348-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x0000000000240000-0x0000000000258000-memory.dmp

Filesize
96KB

Download
memory/2348-2-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads