njrat | b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5ab

General

Target

b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe
Size

118KB
MD5

659e5779fb844ef0f4cffcdf8f8adc40
SHA1

ff803efdcb9cd3735012591e238e15cc55b55e44
SHA256

b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5ab
SHA512

626fd79651a226c9945cab61a6152eed1e742b7f317b51c7558d074ebae85e16ce9f1c9248a008b298bd116753754d913f2410d4f9c08417bee06b120d9f87a1
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLVgt:P5eznsjsguGDFqGZ2rDLE

Score

10^/10

njrat neuf discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2996	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
1760	chargeable.exe
3024	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
2156	b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe
2156	b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe"	b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 3024	1760	chargeable.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe
Token: 33	3024	chargeable.exe
Token: SeIncBasePriorityPrivilege	3024	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1760	2156	b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe	31
PID 2156 wrote to memory of 1760	2156	b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe	31
PID 2156 wrote to memory of 1760	2156	b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe	31
PID 2156 wrote to memory of 1760	2156	b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe	31
PID 1760 wrote to memory of 3024	1760	chargeable.exe	32
PID 1760 wrote to memory of 3024	1760	chargeable.exe	32
PID 1760 wrote to memory of 3024	1760	chargeable.exe	32
PID 1760 wrote to memory of 3024	1760	chargeable.exe	32
PID 1760 wrote to memory of 3024	1760	chargeable.exe	32
PID 1760 wrote to memory of 3024	1760	chargeable.exe	32
PID 1760 wrote to memory of 3024	1760	chargeable.exe	32
PID 1760 wrote to memory of 3024	1760	chargeable.exe	32
PID 1760 wrote to memory of 3024	1760	chargeable.exe	32
PID 3024 wrote to memory of 2996	3024	chargeable.exe	33
PID 3024 wrote to memory of 2996	3024	chargeable.exe	33
PID 3024 wrote to memory of 2996	3024	chargeable.exe	33
PID 3024 wrote to memory of 2996	3024	chargeable.exe	33

C:\Users\Admin\AppData\Local\Temp\b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe
"C:\Users\Admin\AppData\Local\Temp\b7680b33b2552fffc6be3fd01c7a38345f0a9919f3dc7e6d138cf5b94fe3f5abN.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956

Filesize
1KB

MD5
3e3aed1c0ba46c98a8ef6b3bec083998

SHA1
8df2ba67925f2c9580ead34fc567acd35c55b416

SHA256
3fab079f84b987b1a1e305228bd9d2c7dc9a4033b62d3715073c009391fc949f

SHA512
f0afb50c3ca2843e0dde736e5ce6d327ad2b70ae3e04c46c658878208dbd242059efc414f8eff22e9e6034a4a4948b34bdd612c5156c3d9a7fcbd38238066b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aac18f76cc3af77cce55cdc4fc33bdc3

SHA1
2c96f05e828a890747217f5c7e6b0f83a4d6289b

SHA256
2201e8e252c6aa0be629b40e481d2a9dc3bcfcf5edeec71695c9273bdd39c00f

SHA512
4323f7789370ccbcd40a15424f2918ec532d3b8305b69235a3f973299e88d02c71109e6d4fdc26315c40967361d61f7e73b26f81fcc1509265b8d65ef52db58d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cb802c18cc91c7dd492470a79b9c75b

SHA1
ae4fe80e2c57bac089383c60bebdf79a32760232

SHA256
14be7a6b5fe6800ccc6a0fcf0d7c9df983e3a0f5d0f665b58303f58253a2c1b3

SHA512
b08226e11cea440dc54bebbf49a772abf00671530a8211d924e899c5796fa6393d0fdad6a920fd1fa2f30544279e523604a1fd119ed5892a3a5556872692e218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0dd42487a2a18789ba9351f99e45867

SHA1
6d66c52ed284835d3ea6a9496ca99c3fdc655036

SHA256
72e5ad38d766f6672acbca7566b18f00ab8559e56e52aeb08f88f53e035dab74

SHA512
c5dc9b3bfa11da85794d9e1e4cf0ee716707cd51912de11ab9fee230dbf04d4ddd278de70bd55c6192886514a0862aebfecade533cf416d231c09a7a7981186a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956

Filesize
252B

MD5
a33a9ef9d3bf3f6542c809994705a706

SHA1
74c42319a624981717a955d087e73a0abfbc7cf6

SHA256
13f21aae1f175808798e1a0cc17cb64ed499ee6a527ab4c5f38e67b5d04f7e37

SHA512
5dd1d550a681ff6bf8dda0503bd722cd1e71f55198d9d8b778750bc7a7a56fc25fa9fc057d2e927d105dbfd8a660896596ca309bae975749219a047c71115366

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC67.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC7A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Filesize
118KB

MD5
2bc403fee38f1868e4e4bef891e4a9fd

SHA1
e813f4d26386931b6ab7acaf3be4cdb88910a887

SHA256
4b19ad3b7b47c3145c1037c38928d41e3526b29be1f7150b9d1e9f688cec8d93

SHA512
7f7e99c030adbee5358fd7af6c2ecdc2aec7fa1bd96a67a72909bfd04d7ce2672408ed13c748cbefed49980774911c8373fc9b91466b5827dc9973e577f45873

Download Submit
memory/2156-176-0x0000000074CC0000-0x000000007526B000-memory.dmp

Filesize
5.7MB

Download
memory/2156-0-0x0000000074CC1000-0x0000000074CC2000-memory.dmp

Filesize
4KB

Download
memory/2156-166-0x0000000074CC0000-0x000000007526B000-memory.dmp

Filesize
5.7MB

Download
memory/2156-8-0x0000000074CC0000-0x000000007526B000-memory.dmp

Filesize
5.7MB

Download
memory/3024-342-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3024-345-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3024-344-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads