Overview

overview

10

Static

static

10

Server.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    37KB

  • Sample

    241031-3j92gsvdqj

  • MD5

    367587471af9ef8ea4527323895b6466

  • SHA1

    817c50792eabf946846006ebd91322a93a664e45

  • SHA256

    80d6c43e13a4b3d5594b505b15c6d978b5b6bb11a6f1a613dd041f819d399af5

  • SHA512

    0d33e5c9c66a0d99bf29d27a35d7bb3b537bb6b3e0f236172737f416064bd63c5c5b2e4ee625c2c3c6ecef6e9f372a4f89d9d9375fdf2d26f1200999d8d79f1b

  • SSDEEP

    384:FKnraio1n7S5pbpQyEfhqH0f3IYykxarAF+rMRTyN/0L+EcoinblneHQM3epzXJk:MnT3pLEfgH0AlkYrM+rMRa8NufMt

Score
10/10
njrathackeddiscoveryevasionpersistenceprivilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

https://pastebin.com/raw/c5xtcUfn:19900

Mutex

dff9ad4032998f4b9cf8d97f6ee36396

Attributes
  • reg_key

    dff9ad4032998f4b9cf8d97f6ee36396

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      37KB

    • MD5

      367587471af9ef8ea4527323895b6466

    • SHA1

      817c50792eabf946846006ebd91322a93a664e45

    • SHA256

      80d6c43e13a4b3d5594b505b15c6d978b5b6bb11a6f1a613dd041f819d399af5

    • SHA512

      0d33e5c9c66a0d99bf29d27a35d7bb3b537bb6b3e0f236172737f416064bd63c5c5b2e4ee625c2c3c6ecef6e9f372a4f89d9d9375fdf2d26f1200999d8d79f1b

    • SSDEEP

      384:FKnraio1n7S5pbpQyEfhqH0f3IYykxarAF+rMRTyN/0L+EcoinblneHQM3epzXJk:MnT3pLEfgH0AlkYrM+rMRa8NufMt

    Score
    8/10
    discoveryevasionpersistenceprivilege_escalation

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks