njrat | c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814

General

Target

c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
Size

474KB
MD5

9e8fa72316dbbc6e450cc046acb8e695
SHA1

b63c9a9b7937dd2d943444856e59f9c49b888168
SHA256

c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814
SHA512

f7b7b7b9db2090cc7ac4d09827debe968bf5273611c804713b9650bd363741e3f0fe36cde2ae22d3c6e5337563060233ff3289415774f0788c4790fd9753250a
SSDEEP

3072:rwG1Z6pASc9NyxV9/J12vyNBix94P/+ItEXUrbDn45YfOWIXusP:rwGb6KUFhex94P/+jkvDn45iQee

Score

10^/10

njrat west-k.s.a @evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

WeSt-K.S.A @

C2

127.0.0.1:5551

Mutex

0f436963af986f0915e6f175d79d7302

Attributes

reg_key
0f436963af986f0915e6f175d79d7302
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3940	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3940	2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe	83
PID 2716 wrote to memory of 3940	2716	c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe	83

C:\Users\Admin\AppData\Local\Temp\c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
"C:\Users\Admin\AppData\Local\Temp\c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SYSTEM32\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe" "c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2716-0-0x00007FF98BBA3000-0x00007FF98BBA5000-memory.dmp

Filesize
8KB

Download
memory/2716-1-0x0000000000C30000-0x0000000000CAA000-memory.dmp

Filesize
488KB

Download
memory/2716-2-0x0000000001550000-0x000000000155E000-memory.dmp

Filesize
56KB

Download
memory/2716-3-0x00007FF98BBA0000-0x00007FF98C661000-memory.dmp

Filesize
10.8MB

Download
memory/2716-4-0x00007FF98BBA3000-0x00007FF98BBA5000-memory.dmp

Filesize
8KB

Download
memory/2716-5-0x00007FF98BBA0000-0x00007FF98C661000-memory.dmp

Filesize
10.8MB

Download
memory/2716-6-0x00007FF98BBA0000-0x00007FF98C661000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads