njrat | 43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Size

283KB
MD5

457e6dde9b9a222f13926dbcf569c0a3
SHA1

d692b9400d7bbe5747eca83a523c5aecc60bd8f7
SHA256

43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f
SHA512

76a23947a006acd09d3e4e1485948c287411d57e55eefbfb53e68a8fc5d21ed2c91611a365ba7f346d3acb3e8e625bd2c594c81d5130ebe9696e666c0e903796
SSDEEP

6144:i/PXWcpLConxOeKELQyBbMRubcv03Vu8pzhDPTK5pqt55:m/oZdebMw4L8b/

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

21.ip.gl.ply.gg:20595

Mutex

9f12e06941670e24a2101c40e47643c3

Attributes

reg_key
9f12e06941670e24a2101c40e47643c3
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exe

pid	Process
2060	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe

description	pid	Process
Token: SeDebugPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: 33	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
Token: SeIncBasePriorityPrivilege	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe

description	pid	Process	procid_target
PID 772 wrote to memory of 2060	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe	31
PID 772 wrote to memory of 2060	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe	31
PID 772 wrote to memory of 2060	772	43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe	31

C:\Users\Admin\AppData\Local\Temp\43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe
"C:\Users\Admin\AppData\Local\Temp\43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\system32\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe" "43deb5f75dff83f92d2202d243429fb5ab11ce76d37910f285852bb21720c84f.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-0-0x000007FEF601E000-0x000007FEF601F000-memory.dmp

Filesize
4KB

Download
memory/772-1-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/772-2-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/772-3-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/772-4-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/772-5-0x00000000006B0000-0x00000000006C0000-memory.dmp

Filesize
64KB

Download
memory/772-6-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/772-7-0x000007FEF601E000-0x000007FEF601F000-memory.dmp

Filesize
4KB

Download
memory/772-8-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/772-9-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download