njrat | 41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1c

General

Target

41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe
Size

120KB
MD5

b15f2e47a62128a678121c801412bd20
SHA1

57d9f47b977b32fad210569fe619309f9ccb0b55
SHA256

41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1c
SHA512

9f001801c0894b57e991fe3cd7312679c8d0f094b9b541c867cff1969b97b198ffe3dd4d2b85c13fef3bb276f50e52df8187f4a8506bb9c2e8f361a558cd7c0e
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL14FgOC:P5eznsjsguGDFqGZ2rDL14FgX

Score

10^/10

njrat neuf discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2872	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
316	chargeable.exe
2732	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
2068	41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe
2068	41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe"	41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 316 set thread context of 2732	316	chargeable.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe
Token: 33	2732	chargeable.exe
Token: SeIncBasePriorityPrivilege	2732	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 316	2068	41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe	31
PID 2068 wrote to memory of 316	2068	41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe	31
PID 2068 wrote to memory of 316	2068	41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe	31
PID 2068 wrote to memory of 316	2068	41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe	31
PID 316 wrote to memory of 2732	316	chargeable.exe	32
PID 316 wrote to memory of 2732	316	chargeable.exe	32
PID 316 wrote to memory of 2732	316	chargeable.exe	32
PID 316 wrote to memory of 2732	316	chargeable.exe	32
PID 316 wrote to memory of 2732	316	chargeable.exe	32
PID 316 wrote to memory of 2732	316	chargeable.exe	32
PID 316 wrote to memory of 2732	316	chargeable.exe	32
PID 316 wrote to memory of 2732	316	chargeable.exe	32
PID 316 wrote to memory of 2732	316	chargeable.exe	32
PID 2732 wrote to memory of 2872	2732	chargeable.exe	33
PID 2732 wrote to memory of 2872	2732	chargeable.exe	33
PID 2732 wrote to memory of 2872	2732	chargeable.exe	33
PID 2732 wrote to memory of 2872	2732	chargeable.exe	33

C:\Users\Admin\AppData\Local\Temp\41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe
"C:\Users\Admin\AppData\Local\Temp\41b408aa63dfbb34c93d61206de020607822c3809efd07f006f07780c15f8a1cN.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eff961e306aefd3903672e4d0776c254

SHA1
45f6621bd188ffbbcccf05728d302d29bb5d54d7

SHA256
11464cf7c761148195f417e79cfe989e3df288b2adf9a5e3ad8bec34024e7298

SHA512
ffe975c668be35e6622a61a94bb6ab3703d736132bde3558c0c0a656d9caaca70f52c70847f2c5f414277931e745bfe56a5922d1891de829926a8db1287128e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
371c9702a6908d0fef22481fcac2c590

SHA1
3c5d02d28b568df58eb0016f144292c49d4f690d

SHA256
754be5d249d35d91cb19511a5303ee9999ed3c3a29b75d7d744d111e1fcb685e

SHA512
531366f18a8e5245c4711ece1c86f17f9c7c6fcf77125920a1542431bce99c5adba8db64214a62924c708aff4b432f22f3b3d16918652f8b6636d79238a1e91b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b071b0705874cd32ab84220b39ad25dd

SHA1
879b17d46c11a694855b32a029d51e8d6dd02780

SHA256
ae3841c523de7fe1c89a9b7f8d243a26c6c8dcb33a84eab8e4d9f8be1d2e76a3

SHA512
24d58f72be5f375778ae5564b9ec9be51d8b27422ab303e3374fc8bfc006b79002160e4d5de41da36a1df3144b15ad2ab8c4b185d6474cc092a83a5c1997bf40

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD27D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD280.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Filesize
120KB

MD5
124f273a7c67b2c9e3138bbf155d0bf3

SHA1
d77b6ca2063325f6d2c8bd4fb1a841fe86cd5415

SHA256
f919ca3e580476c888100188998a0922c0a5558e7ad99ce081f4c8bd8e8dc518

SHA512
ac4fd65b1fcf536af82de9429cc3399076f85e4337a99eb10ccc924be5cc0108555828300c78bde31581c9c7e75452c001790ae6faf35aaf650070fa958e5723

Download Submit
memory/2068-0-0x0000000074A81000-0x0000000074A82000-memory.dmp

Filesize
4KB

Download
memory/2068-164-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/2068-174-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/2068-2-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/2068-1-0x0000000074A80000-0x000000007502B000-memory.dmp

Filesize
5.7MB

Download
memory/2732-338-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2732-341-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2732-340-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads