njrat | b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe
Size

39KB
MD5

5a6e0971a54847d4cecc16bf7fa44bca
SHA1

b0b5d4f2cfe7a64addb17796ba41353c57a57f91
SHA256

b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223
SHA512

90362f72a78c257eba31a9bc5089d02db626a985f78d5ec8f97dadd743ef4c2b9fc434f318faea27d0e41e03cddeec94536f5bcd29a1ff77f14fe2d44a8b823e
SSDEEP

768:VvAl92nMe/UYPlfk4l3QYp6LxybXDIAfjP/m/NyE3NSTM8udmmBDnu:i4DzPlfk4JQm6L47BfbIyzM8udmmFu

Score

10^/10

njrat uzbek persistence trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

uzbek

127.0.0.1:14026

Mutex

yzbekt.exe

Attributes

reg_key
yzbekt.exe
splitter
|Ghost|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe

Executes dropped EXE 1 IoCs

pid	Process
4972	yzbekt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .."	yzbekt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .."	yzbekt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
28	0.tcp.eu.ngrok.io
77	0.tcp.eu.ngrok.io
110	0.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe
4972	yzbekt.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe
Token: 33	4972	yzbekt.exe
Token: SeIncBasePriorityPrivilege	4972	yzbekt.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 4972	1212	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe	91
PID 1212 wrote to memory of 4972	1212	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe	91
PID 1212 wrote to memory of 2724	1212	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe	92
PID 1212 wrote to memory of 2724	1212	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe	92
PID 2724 wrote to memory of 2560	2724	cmd.exe	95
PID 2724 wrote to memory of 2560	2724	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe
"C:\Users\Admin\AppData\Local\Temp\b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Roaming\yzbekt.exe
  "C:\Users\Admin\AppData\Roaming\yzbekt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\yzbekt.exe

Filesize
39KB

MD5
5a6e0971a54847d4cecc16bf7fa44bca

SHA1
b0b5d4f2cfe7a64addb17796ba41353c57a57f91

SHA256
b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223

SHA512
90362f72a78c257eba31a9bc5089d02db626a985f78d5ec8f97dadd743ef4c2b9fc434f318faea27d0e41e03cddeec94536f5bcd29a1ff77f14fe2d44a8b823e

Download Submit
memory/1212-0-0x00007FFCCA2A5000-0x00007FFCCA2A6000-memory.dmp

Filesize
4KB

Download
memory/1212-1-0x00007FFCC9FF0000-0x00007FFCCA991000-memory.dmp

Filesize
9.6MB

Download
memory/1212-2-0x000000001B620000-0x000000001BAEE000-memory.dmp

Filesize
4.8MB

Download
memory/1212-3-0x000000001B070000-0x000000001B086000-memory.dmp

Filesize
88KB

Download
memory/1212-4-0x000000001BAF0000-0x000000001BB96000-memory.dmp

Filesize
664KB

Download
memory/1212-5-0x00007FFCC9FF0000-0x00007FFCCA991000-memory.dmp

Filesize
9.6MB

Download
memory/1212-16-0x00007FFCC9FF0000-0x00007FFCCA991000-memory.dmp

Filesize
9.6MB

Download
memory/4972-17-0x00007FFCC9FF0000-0x00007FFCCA991000-memory.dmp

Filesize
9.6MB

Download
memory/4972-15-0x00007FFCC9FF0000-0x00007FFCCA991000-memory.dmp

Filesize
9.6MB

Download
memory/4972-18-0x00007FFCC9FF0000-0x00007FFCCA991000-memory.dmp

Filesize
9.6MB

Download
memory/4972-19-0x000000001C040000-0x000000001C0DC000-memory.dmp

Filesize
624KB

Download
memory/4972-20-0x0000000000B60000-0x0000000000B68000-memory.dmp

Filesize
32KB

Download
memory/4972-21-0x000000001C850000-0x000000001C8B2000-memory.dmp

Filesize
392KB

Download
memory/4972-22-0x000000001CD50000-0x000000001CD69000-memory.dmp

Filesize
100KB

Download
memory/4972-23-0x00007FFCC9FF0000-0x00007FFCCA991000-memory.dmp

Filesize
9.6MB

Download
memory/4972-24-0x00007FFCC9FF0000-0x00007FFCCA991000-memory.dmp

Filesize
9.6MB

Download
memory/4972-25-0x00007FFCC9FF0000-0x00007FFCCA991000-memory.dmp

Filesize
9.6MB

Download