njrat | 39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0

General

Target

39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0.exe
Size

75KB
MD5

22ce647526270fdbd18e1e4e603482f3
SHA1

1564549571731bbae399933b8e5d59525bd44ffd
SHA256

39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0
SHA512

24c8e1b7031dacc87abcfb8cc16f2fd8e1ef3b86661e4200b87fb395db1d797babbd4163a09d2507f00baf81f0ad188d3c153361136853b840bc75912fa9cfe0
SSDEEP

1536:zd/KqwpacXtNYjonQekfnBTIVXFyeOkTMO8hzGXZ5ZF:zdrEBdNYjo/kiVgk4ThSHZF

Score

10^/10

njrat تــــــــــــــــلغيم الســـــــــــــــــــــــــ evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

تــــــــــــــــلغيم الســـــــــــــــــــــــــيد آسسسسسد الديـــــراني ...

C2

army.ddns.net:1180

Mutex

322327d13a2d77e5f8392bd8b7d06a37

Attributes

reg_key
322327d13a2d77e5f8392bd8b7d06a37
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1272	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\322327d13a2d77e5f8392bd8b7d06a37.exe	System IP.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\322327d13a2d77e5f8392bd8b7d06a37.exe	System IP.exe

Executes dropped EXE 1 IoCs

pid	Process
2936	System IP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	System IP.exe
Token: 33	2936	System IP.exe
Token: SeIncBasePriorityPrivilege	2936	System IP.exe
Token: 33	2936	System IP.exe
Token: SeIncBasePriorityPrivilege	2936	System IP.exe
Token: 33	2936	System IP.exe
Token: SeIncBasePriorityPrivilege	2936	System IP.exe
Token: 33	2936	System IP.exe
Token: SeIncBasePriorityPrivilege	2936	System IP.exe
Token: 33	2936	System IP.exe
Token: SeIncBasePriorityPrivilege	2936	System IP.exe
Token: 33	2936	System IP.exe
Token: SeIncBasePriorityPrivilege	2936	System IP.exe
Token: 33	2936	System IP.exe
Token: SeIncBasePriorityPrivilege	2936	System IP.exe
Token: 33	2936	System IP.exe
Token: SeIncBasePriorityPrivilege	2936	System IP.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 2936	1160	39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0.exe	96
PID 1160 wrote to memory of 2936	1160	39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0.exe	96
PID 2936 wrote to memory of 1272	2936	System IP.exe	101
PID 2936 wrote to memory of 1272	2936	System IP.exe	101

C:\Users\Admin\AppData\Local\Temp\39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0.exe
"C:\Users\Admin\AppData\Local\Temp\39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\System IP.exe
  "C:\Users\Admin\AppData\Local\Temp\System IP.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SYSTEM32\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System IP.exe" "System IP.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\System IP.exe

Filesize
75KB

MD5
22ce647526270fdbd18e1e4e603482f3

SHA1
1564549571731bbae399933b8e5d59525bd44ffd

SHA256
39e8ba6f38d52bb24f88ebcbfbca1789535664226b71dfaae2e3571c5aea08c0

SHA512
24c8e1b7031dacc87abcfb8cc16f2fd8e1ef3b86661e4200b87fb395db1d797babbd4163a09d2507f00baf81f0ad188d3c153361136853b840bc75912fa9cfe0

Download Submit
memory/1160-3-0x000000001BDD0000-0x000000001BE6C000-memory.dmp

Filesize
624KB

Download
memory/1160-8-0x000000001BF70000-0x000000001C016000-memory.dmp

Filesize
664KB

Download
memory/1160-0-0x00007FF8E8755000-0x00007FF8E8756000-memory.dmp

Filesize
4KB

Download
memory/1160-4-0x00007FF8E84A0000-0x00007FF8E8E41000-memory.dmp

Filesize
9.6MB

Download
memory/1160-5-0x00007FF8E8755000-0x00007FF8E8756000-memory.dmp

Filesize
4KB

Download
memory/1160-6-0x00007FF8E84A0000-0x00007FF8E8E41000-memory.dmp

Filesize
9.6MB

Download
memory/1160-7-0x000000001BEB0000-0x000000001BEBC000-memory.dmp

Filesize
48KB

Download
memory/1160-2-0x00007FF8E84A0000-0x00007FF8E8E41000-memory.dmp

Filesize
9.6MB

Download
memory/1160-1-0x000000001B860000-0x000000001BD2E000-memory.dmp

Filesize
4.8MB

Download
memory/1160-21-0x00007FF8E84A0000-0x00007FF8E8E41000-memory.dmp

Filesize
9.6MB

Download
memory/2936-22-0x00007FF8E84A0000-0x00007FF8E8E41000-memory.dmp

Filesize
9.6MB

Download
memory/2936-23-0x00007FF8E84A0000-0x00007FF8E8E41000-memory.dmp

Filesize
9.6MB

Download
memory/2936-24-0x00007FF8E84A0000-0x00007FF8E8E41000-memory.dmp

Filesize
9.6MB

Download
memory/2936-26-0x0000000001530000-0x0000000001538000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads