njrat | bd7cea2a6ca9838482956acdfb324911c9a96a6801a34221deb35ee3a7e04230 | Triage

Sharing

General

Target

TimeTravel2.0PRIVATE.exe
Size

37KB
Sample

241005-va2praxcmq
MD5

c0622865d16a983583fd648b788066ed
SHA1

f186dd87ed741a70d36095e422249ddf913fd950
SHA256

bd7cea2a6ca9838482956acdfb324911c9a96a6801a34221deb35ee3a7e04230
SHA512

4664135eafd1daf50fd0e8684ca9e55898763d657745c2644ffd18a2638ba1ac8c45e71ec3c93b995ba11d34671bb8a9ff54e5c9ccd336082acdda62188ea88e
SSDEEP

384:vD6rp7Lsik79zNf/1uyU77cPbxs2cPWrAF+rMRTyN/0L+EcoinblneHQM3epzXTm:mrRWl1lU77c1FcerM+rMRa8NuFit

Score

10^/10

njrat timetravel2 discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

timetravel2

C2

194.44.57.113:5552

Mutex

91137d4eb023a57c126288b3b00270ca

Attributes

reg_key
91137d4eb023a57c126288b3b00270ca
splitter
|'|'|

Targets

- Target
  
  TimeTravel2.0PRIVATE.exe
- Size
  
  37KB
- MD5
  
  c0622865d16a983583fd648b788066ed
- SHA1
  
  f186dd87ed741a70d36095e422249ddf913fd950
- SHA256
  
  bd7cea2a6ca9838482956acdfb324911c9a96a6801a34221deb35ee3a7e04230
- SHA512
  
  4664135eafd1daf50fd0e8684ca9e55898763d657745c2644ffd18a2638ba1ac8c45e71ec3c93b995ba11d34671bb8a9ff54e5c9ccd336082acdda62188ea88e
- SSDEEP
  
  384:vD6rp7Lsik79zNf/1uyU77cPbxs2cPWrAF+rMRTyN/0L+EcoinblneHQM3epzXTm:mrRWl1lU77c1FcerM+rMRa8NuFit
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

timetravel2njrat

behavioral1

discoveryevasionpersistenceprivilege_escalation