njrat | 48dccd7cdd21e0ad2316fa25fc8fadbfe7b1d6088e6aa1de0d83141b2bb89e8c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe
Size

39KB
MD5

5a6e0971a54847d4cecc16bf7fa44bca
SHA1

b0b5d4f2cfe7a64addb17796ba41353c57a57f91
SHA256

b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223
SHA512

90362f72a78c257eba31a9bc5089d02db626a985f78d5ec8f97dadd743ef4c2b9fc434f318faea27d0e41e03cddeec94536f5bcd29a1ff77f14fe2d44a8b823e
SSDEEP

768:VvAl92nMe/UYPlfk4l3QYp6LxybXDIAfjP/m/NyE3NSTM8udmmBDnu:i4DzPlfk4JQm6L47BfbIyzM8udmmFu

Score

10^/10

njrat uzbek persistence trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

uzbek

127.0.0.1:14026

Mutex

yzbekt.exe

Attributes

reg_key
yzbekt.exe
splitter
|Ghost|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe

Executes dropped EXE 1 IoCs

pid	Process
2868	yzbekt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .."	yzbekt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzbekt.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\yzbekt.exe\" .."	yzbekt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
66	0.tcp.eu.ngrok.io
90	0.tcp.eu.ngrok.io
29	0.tcp.eu.ngrok.io
32	0.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe
2868	yzbekt.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe
Token: 33	2868	yzbekt.exe
Token: SeIncBasePriorityPrivilege	2868	yzbekt.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 2868	3776	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe	92
PID 3776 wrote to memory of 2868	3776	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe	92
PID 3776 wrote to memory of 4892	3776	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe	94
PID 3776 wrote to memory of 4892	3776	b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe	94
PID 4892 wrote to memory of 1040	4892	cmd.exe	96
PID 4892 wrote to memory of 1040	4892	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe
"C:\Users\Admin\AppData\Local\Temp\b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Users\Admin\AppData\Roaming\yzbekt.exe
  "C:\Users\Admin\AppData\Roaming\yzbekt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\yzbekt.exe

Filesize
39KB

MD5
5a6e0971a54847d4cecc16bf7fa44bca

SHA1
b0b5d4f2cfe7a64addb17796ba41353c57a57f91

SHA256
b44b1273d8b923127c0f5279cb143abf156cda0b03d083f8424c54ec4bbb7223

SHA512
90362f72a78c257eba31a9bc5089d02db626a985f78d5ec8f97dadd743ef4c2b9fc434f318faea27d0e41e03cddeec94536f5bcd29a1ff77f14fe2d44a8b823e

Download Submit
memory/2868-16-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp

Filesize
9.6MB

Download
memory/2868-23-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp

Filesize
9.6MB

Download
memory/2868-22-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp

Filesize
9.6MB

Download
memory/2868-21-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp

Filesize
9.6MB

Download
memory/2868-20-0x00000000010E0000-0x00000000010E8000-memory.dmp

Filesize
32KB

Download
memory/2868-19-0x000000001C2F0000-0x000000001C38C000-memory.dmp

Filesize
624KB

Download
memory/2868-15-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp

Filesize
9.6MB

Download
memory/2868-18-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp

Filesize
9.6MB

Download
memory/3776-4-0x000000001C680000-0x000000001C726000-memory.dmp

Filesize
664KB

Download
memory/3776-17-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp

Filesize
9.6MB

Download
memory/3776-5-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp

Filesize
9.6MB

Download
memory/3776-0-0x00007FF8E4595000-0x00007FF8E4596000-memory.dmp

Filesize
4KB

Download
memory/3776-3-0x0000000001740000-0x0000000001756000-memory.dmp

Filesize
88KB

Download
memory/3776-1-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp

Filesize
9.6MB

Download
memory/3776-2-0x000000001C100000-0x000000001C5CE000-memory.dmp

Filesize
4.8MB

Download