njrat | 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-11-2024 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
Size

65KB
MD5

bf27a2b1c3a091d14d52d660baa90f40
SHA1

45ff2043a8124b5b7c7f41f2493b501b2be720f8
SHA256

28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3
SHA512

bfeefe304051b148083a0baa9a67d15e10948292e36ce746c98f1ccf4bd15ca1e7520e09aa75d6b89788473208625e183a47a69a51745db0f139330a1ab2594a
SSDEEP

1536:hcEIhoN36t+QviFw1CcWSUVOBnvb9fLteF3nLrB9z3ncaF9bSS9vMp:hcEIhoN36t+QviFCCl8BnJfWl9zsaF9Y

Score

10^/10

njrat hacked discovery trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

127.0.0.1:40570

Mutex

MicrosoftBrake

Attributes

reg_key
MicrosoftBrake
splitter
|Ghost|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Deletes itself 1 IoCs

pid	Process
2924	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\MicrosoftBrake	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2696	AcroRd32.exe
2696	AcroRd32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2692	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	30
PID 2668 wrote to memory of 2692	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	30
PID 2668 wrote to memory of 2692	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	30
PID 2668 wrote to memory of 2692	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	30
PID 2668 wrote to memory of 2692	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	30
PID 2668 wrote to memory of 2692	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	30
PID 2668 wrote to memory of 2692	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	30
PID 2668 wrote to memory of 2924	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	31
PID 2668 wrote to memory of 2924	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	31
PID 2668 wrote to memory of 2924	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	31
PID 2668 wrote to memory of 2924	2668	28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe	31
PID 2924 wrote to memory of 2584	2924	cmd.exe	33
PID 2924 wrote to memory of 2584	2924	cmd.exe	33
PID 2924 wrote to memory of 2584	2924	cmd.exe	33
PID 2924 wrote to memory of 2584	2924	cmd.exe	33
PID 2692 wrote to memory of 2696	2692	rundll32.exe	34
PID 2692 wrote to memory of 2696	2692	rundll32.exe	34
PID 2692 wrote to memory of 2696	2692	rundll32.exe	34
PID 2692 wrote to memory of 2696	2692	rundll32.exe	34

C:\Users\Admin\AppData\Local\Temp\28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
"C:\Users\Admin\AppData\Local\Temp\28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\MicrosoftBrake
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Windows\MicrosoftBrake"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0de0312fe1bc01c74ae23daf2a941e3b

SHA1
e947799c9d938da0794324ae2e57696eb2f971fa

SHA256
0243ba52c86a4369f432f237872e340ec8d022db8a1b195650fed02b850a1b88

SHA512
9df858468c69a4de7f1283c7da41f9f822a7cd2b0aee5d5b8c5fe77f9cd2f946827fbd7656e49c377a974b044e62b6fdf63e5f6476d3a5c2cf4a409d12e15ca5

Download Submit
C:\Windows\MicrosoftBrake

Filesize
65KB

MD5
bf27a2b1c3a091d14d52d660baa90f40

SHA1
45ff2043a8124b5b7c7f41f2493b501b2be720f8

SHA256
28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3

SHA512
bfeefe304051b148083a0baa9a67d15e10948292e36ce746c98f1ccf4bd15ca1e7520e09aa75d6b89788473208625e183a47a69a51745db0f139330a1ab2594a

Download Submit
memory/2668-0-0x0000000074EB1000-0x0000000074EB2000-memory.dmp

Filesize
4KB

Download
memory/2668-1-0x0000000074EB0000-0x000000007545B000-memory.dmp

Filesize
5.7MB

Download
memory/2668-2-0x0000000074EB0000-0x000000007545B000-memory.dmp

Filesize
5.7MB

Download
memory/2668-5-0x0000000074EB0000-0x000000007545B000-memory.dmp

Filesize
5.7MB

Download