njrat | 88ec1a1189573981d407cbb781939a413097f249b746f0eba01576fb7961f099

General

Target

Lads beams v2.exe
Size

7.6MB
MD5

2c5d4639d934ec4ca3ecef06aec24c1d
SHA1

183218073c262d05a32bfdd4976a19de297b4d37
SHA256

88ec1a1189573981d407cbb781939a413097f249b746f0eba01576fb7961f099
SHA512

a8f0705e955ec0fd01a988b45504727c340f97cc79338ceb446f0b33869aac130759e92f790b05632ef7c786af3743f19b8ba55a1dc7c3684959937d8e40009e
SSDEEP

196608:khrPh9Gs3WVaCbpHMwg4q9QFzAZNbUHYFSsNez:QlEsGHpJg40QyZlCIDq

Score

10^/10

njrat hacked defense_evasion discovery evasion persistence privilege_escalation trojan upx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

147.185.221.16:36189

Mutex

58e766d3ca8017f8bd7d37d2b9bad0e2

Attributes

reg_key
58e766d3ca8017f8bd7d37d2b9bad0e2
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

1940 netsh.exe
2864 netsh.exe
Executes dropped EXE 4 IoCs

Processes:

Server.exeBuilt.exeBuilt.exe

pid process

2376 Server.exe
3016 Built.exe
2888 Built.exe
1248
Loads dropped DLL 5 IoCs

Processes:

Lads beams v2.exeBuilt.exeBuilt.exe

pid process

2400 Lads beams v2.exe
2400 Lads beams v2.exe
3016 Built.exe
2888 Built.exe
1248

pid	process
1940	netsh.exe
2864	netsh.exe

pid	process
2376	Server.exe
3016	Built.exe
2888	Built.exe
1248

pid	process
2400	Lads beams v2.exe
2400	Lads beams v2.exe
3016	Built.exe
2888	Built.exe
1248

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Server.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\58e766d3ca8017f8bd7d37d2b9bad0e2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\58e766d3ca8017f8bd7d37d2b9bad0e2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI30162\python313.dll	upx
behavioral1/memory/2888-39-0x000007FEF5B20000-0x000007FEF6183000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exenetsh.exenetsh.execmd.exePING.EXELads beams v2.exeServer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lads beams v2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

2820 cmd.exe
2456 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2456 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1640 powershell.exe

pid	process
2820	cmd.exe
2456	PING.EXE

pid	process
2456	PING.EXE

pid	process
1640	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exeServer.exe

description	pid	process
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	2376	Server.exe
Token: 33	2376	Server.exe
Token: SeIncBasePriorityPrivilege	2376	Server.exe
Token: 33	2376	Server.exe
Token: SeIncBasePriorityPrivilege	2376	Server.exe
Token: 33	2376	Server.exe
Token: SeIncBasePriorityPrivilege	2376	Server.exe
Token: 33	2376	Server.exe
Token: SeIncBasePriorityPrivilege	2376	Server.exe
Token: 33	2376	Server.exe
Token: SeIncBasePriorityPrivilege	2376	Server.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

Lads beams v2.exeBuilt.exeServer.execmd.exe

description	pid	process	target process
PID 2400 wrote to memory of 1640	2400	Lads beams v2.exe	powershell.exe
PID 2400 wrote to memory of 1640	2400	Lads beams v2.exe	powershell.exe
PID 2400 wrote to memory of 1640	2400	Lads beams v2.exe	powershell.exe
PID 2400 wrote to memory of 1640	2400	Lads beams v2.exe	powershell.exe
PID 2400 wrote to memory of 2376	2400	Lads beams v2.exe	Server.exe
PID 2400 wrote to memory of 2376	2400	Lads beams v2.exe	Server.exe
PID 2400 wrote to memory of 2376	2400	Lads beams v2.exe	Server.exe
PID 2400 wrote to memory of 2376	2400	Lads beams v2.exe	Server.exe
PID 2400 wrote to memory of 3016	2400	Lads beams v2.exe	Built.exe
PID 2400 wrote to memory of 3016	2400	Lads beams v2.exe	Built.exe
PID 2400 wrote to memory of 3016	2400	Lads beams v2.exe	Built.exe
PID 2400 wrote to memory of 3016	2400	Lads beams v2.exe	Built.exe
PID 3016 wrote to memory of 2888	3016	Built.exe	Built.exe
PID 3016 wrote to memory of 2888	3016	Built.exe	Built.exe
PID 3016 wrote to memory of 2888	3016	Built.exe	Built.exe
PID 2376 wrote to memory of 1940	2376	Server.exe	netsh.exe
PID 2376 wrote to memory of 1940	2376	Server.exe	netsh.exe
PID 2376 wrote to memory of 1940	2376	Server.exe	netsh.exe
PID 2376 wrote to memory of 1940	2376	Server.exe	netsh.exe
PID 2376 wrote to memory of 2864	2376	Server.exe	netsh.exe
PID 2376 wrote to memory of 2864	2376	Server.exe	netsh.exe
PID 2376 wrote to memory of 2864	2376	Server.exe	netsh.exe
PID 2376 wrote to memory of 2864	2376	Server.exe	netsh.exe
PID 2376 wrote to memory of 2820	2376	Server.exe	cmd.exe
PID 2376 wrote to memory of 2820	2376	Server.exe	cmd.exe
PID 2376 wrote to memory of 2820	2376	Server.exe	cmd.exe
PID 2376 wrote to memory of 2820	2376	Server.exe	cmd.exe
PID 2820 wrote to memory of 2456	2820	cmd.exe	PING.EXE
PID 2820 wrote to memory of 2456	2820	cmd.exe	PING.EXE
PID 2820 wrote to memory of 2456	2820	cmd.exe	PING.EXE
PID 2820 wrote to memory of 2456	2820	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\Lads beams v2.exe
"C:\Users\Admin\AppData\Local\Temp\Lads beams v2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AcQBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAZABiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AYQBkACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAbABqACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1940
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\SysWOW64\PING.EXE
      ping 0 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2456
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Built.exe

Filesize
7.6MB

MD5
b92eba27150cf61dbacf52a84e9572b7

SHA1
df3fa08d4dd02cc1e18c3d5e4d4722e76ed24895

SHA256
7b52991e02be1da153c975a2fc95d1253b96dabc473cc9f2d5bd745ba1cbc17f

SHA512
c0c1c6e6539e31e216e13df10aff1174d4c082c0b7a10f03635d24c9b3fd183790ffdc909ad2cb1ca07637e5852e5bdb1337f0524ea3408c5ff5e96021a0f4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30162\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
23KB

MD5
1702a7d13a257d4d4421e07700980ab9

SHA1
6400de3b12e571415b2570b8ecbf44f9ad9be9be

SHA256
5449c68208969baea8135a628d27523edaad887b8f4757e29611d892881212af

SHA512
a3e11b0cec2b565923aec7a0d3d210ca6d6c4c6abf6c1308e9f7712824947081d036ee82bc405c59f34f39b7adbc86487a832ac378ac8520149ecc397a52ef41

Download Submit
memory/2376-28-0x0000000000B40000-0x0000000000B80000-memory.dmp

Filesize
256KB

Download
memory/2376-44-0x0000000000B40000-0x0000000000B80000-memory.dmp

Filesize
256KB

Download
memory/2888-39-0x000007FEF5B20000-0x000007FEF6183000-memory.dmp

Filesize
6.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads