njrat | 6db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8

Reason

Machine shutdown

General

Target

New Client.exe
Size

65KB
MD5

418617925234cf8529050924c905963c
SHA1

d0ee8f492b22dbea6323c8ff0ae8f38b15e68f91
SHA256

6db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8
SHA512

e81c7d29b57d26bf208f47d48a1119244b3bedaa213138eff2317791dd91b0b7eb77eb9b1f2cb1425a0668d351133acbbb91a9dc5005f22d0482f4b5505fa415
SSDEEP

1536:efqK4Tm4BoN36t4QviFw1AjHkBnvbKfLteF3nLrB9z3nIaF9bHS9vM:efqK4C4BoN36t4QviFC8EBnefWl9zYaL

Score

10^/10

njrat hacked discovery persistence trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:36811

Mutex

svhost.exe

Attributes

reg_key
svhost.exe
splitter
|Ghost|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 3 IoCs

pid	Process
740	svhost.exe
5868	svhost.exe
276	svhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost.exe\" .."	svhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2080	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "55"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3048	schtasks.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: 33	740	svhost.exe
Token: SeIncBasePriorityPrivilege	740	svhost.exe
Token: SeShutdownPrivilege	1708	shutdown.exe
Token: SeRemoteShutdownPrivilege	1708	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
464	LogonUI.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 740	3916	New Client.exe	82
PID 3916 wrote to memory of 740	3916	New Client.exe	82
PID 3916 wrote to memory of 740	3916	New Client.exe	82
PID 3916 wrote to memory of 5852	3916	New Client.exe	83
PID 3916 wrote to memory of 5852	3916	New Client.exe	83
PID 3916 wrote to memory of 5852	3916	New Client.exe	83
PID 5852 wrote to memory of 3180	5852	cmd.exe	85
PID 5852 wrote to memory of 3180	5852	cmd.exe	85
PID 5852 wrote to memory of 3180	5852	cmd.exe	85
PID 740 wrote to memory of 2080	740	svhost.exe	86
PID 740 wrote to memory of 2080	740	svhost.exe	86
PID 740 wrote to memory of 2080	740	svhost.exe	86
PID 740 wrote to memory of 2104	740	svhost.exe	88
PID 740 wrote to memory of 2104	740	svhost.exe	88
PID 740 wrote to memory of 2104	740	svhost.exe	88
PID 740 wrote to memory of 3048	740	svhost.exe	90
PID 740 wrote to memory of 3048	740	svhost.exe	90
PID 740 wrote to memory of 3048	740	svhost.exe	90
PID 740 wrote to memory of 1708	740	svhost.exe	95
PID 740 wrote to memory of 1708	740	svhost.exe	95
PID 740 wrote to memory of 1708	740	svhost.exe	95

C:\Users\Admin\AppData\Local\Temp\New Client.exe
"C:\Users\Admin\AppData\Local\Temp\New Client.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- - C:\Windows\SysWOW64\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /s /t 00
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5868

C:\Users\Admin\AppData\Local\Temp\svhost.exe
C:\Users\Admin\AppData\Local\Temp\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:276

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a18855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svhost.exe.log

Filesize
418B

MD5
be0f156c1e85296aedb6a369aecaad79

SHA1
c6bf4a0ca9dedc89d3e5c80dc719b192a7fb2d68

SHA256
5180fcf7402ced58140b920bf818eab64613a0e0ded1091eebf14cb57a80590a

SHA512
4968dd9c9647f15c9623736e207788e2a48bdd35419ef88b0a0563314baa373132093444280cb050c28ace657a22db703b55ba0803b1cb63232692cc6d3f0d2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
65KB

MD5
418617925234cf8529050924c905963c

SHA1
d0ee8f492b22dbea6323c8ff0ae8f38b15e68f91

SHA256
6db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8

SHA512
e81c7d29b57d26bf208f47d48a1119244b3bedaa213138eff2317791dd91b0b7eb77eb9b1f2cb1425a0668d351133acbbb91a9dc5005f22d0482f4b5505fa415

Download Submit
memory/740-18-0x0000000005900000-0x000000000590A000-memory.dmp

Filesize
40KB

Download
memory/740-19-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Filesize
408KB

Download
memory/740-29-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/740-15-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/740-16-0x0000000005B10000-0x0000000005BA2000-memory.dmp

Filesize
584KB

Download
memory/740-17-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/740-26-0x0000000006DD0000-0x0000000006DF2000-memory.dmp

Filesize
136KB

Download
memory/740-25-0x0000000005D90000-0x0000000005D9E000-memory.dmp

Filesize
56KB

Download
memory/740-20-0x0000000006A70000-0x0000000006A88000-memory.dmp

Filesize
96KB

Download
memory/740-21-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/740-22-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/3916-3-0x0000000005240000-0x00000000057E6000-memory.dmp

Filesize
5.6MB

Download
memory/3916-0-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download
memory/3916-1-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download
memory/3916-2-0x0000000004BF0000-0x0000000004C8C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads