njrat | 3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061

Analysis

max time kernel
147s
max time network
143s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Size

524KB
MD5

43fbab667475e2717bbfa907ac2b6786
SHA1

8d5af9836a8713aeed86424189d2cdb8b4318a8d
SHA256

3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061
SHA512

620ed0f8bbe926d4cce8474f4f70e29011bbcef2e3f7be74a6590d134a34f2781f478c4283626f9b53d8cf9054ae3ac83b1ff4d3ccdd67b94c6c24d43f79c474
SSDEEP

12288:irOj+Ri3AgFdNfsuqW8BDSkiqD7hWw+OwZkT:UQ3AgFsuqBXDPj

Score

10^/10

njrat hacked discovery execution trojan

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

103.186.117.182:7788

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2360	powershell.exe
2936	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 772 set thread context of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
2936	powershell.exe
2360	powershell.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: 33	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
Token: SeIncBasePriorityPrivilege	2884	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2360	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	31
PID 772 wrote to memory of 2360	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	31
PID 772 wrote to memory of 2360	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	31
PID 772 wrote to memory of 2360	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	31
PID 772 wrote to memory of 2936	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	33
PID 772 wrote to memory of 2936	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	33
PID 772 wrote to memory of 2936	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	33
PID 772 wrote to memory of 2936	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	33
PID 772 wrote to memory of 2964	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	34
PID 772 wrote to memory of 2964	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	34
PID 772 wrote to memory of 2964	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	34
PID 772 wrote to memory of 2964	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	34
PID 772 wrote to memory of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37
PID 772 wrote to memory of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37
PID 772 wrote to memory of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37
PID 772 wrote to memory of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37
PID 772 wrote to memory of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37
PID 772 wrote to memory of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37
PID 772 wrote to memory of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37
PID 772 wrote to memory of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37
PID 772 wrote to memory of 2884	772	3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe	37

C:\Users\Admin\AppData\Local\Temp\3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
"C:\Users\Admin\AppData\Local\Temp\3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GhImdAUxyGDCFQ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GhImdAUxyGDCFQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp19F6.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2964
- C:\Users\Admin\AppData\Local\Temp\3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe
  "C:\Users\Admin\AppData\Local\Temp\3f3bada42f1509f4e1e64c0a84ceaf8d1a96db9c6254330d51c2e150c86eb061.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp19F6.tmp

Filesize
1KB

MD5
233f3730f34e0ecaaec757607e39daa8

SHA1
bdde1f79c5bad8cd3bb4b25ff57a823b0558e0d5

SHA256
fc55f3ee6789adadd7112b6bac578a4f4d9530612fe82a1664ee1d805a565ad0

SHA512
435a899a821dd9b90ea11f48d5ba52ec4461211255824ae8af54a247d3789fa4b60726f6f9dfd10f60b359e8469b40e4ee160bab7f03067317d0a95e8f2e84d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XI53XJZMBGDQR0W667HM.temp

Filesize
7KB

MD5
6d63c8bcd6b5f33175ede599429f811f

SHA1
6b2afc58b865aed1fef1994614b1d1270df983a5

SHA256
4b764a4eb5108331e56b26a330e3bb67624d00c674fe2d15df09b3ad9f5eeaf7

SHA512
e9961954b07b607bc469e4ead04d5c6605528d9b8834cc3f8d4178d4edfd810852e2659349f65fe9750d702c2838781cf35fcccfa70130c094c097d4f91ad6e7

Download Submit
memory/772-4-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/772-34-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/772-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/772-5-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/772-6-0x0000000002190000-0x00000000021E2000-memory.dmp

Filesize
328KB

Download
memory/772-2-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/772-1-0x0000000000960000-0x00000000009E4000-memory.dmp

Filesize
528KB

Download
memory/772-3-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/2884-19-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2884-29-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2884-28-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2884-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2884-25-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2884-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2884-21-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2884-31-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download