njrat | 8f74d8dcb94fe2599559dee63511ed67eb75fa47cb8b75104002c4baca0e460e

General

Target

GorkerPrivate.exe
Size

895KB
MD5

533cfcfdbce621d1a75048ed80c82113
SHA1

b840f235522f8775e0f590d65580fc511c63762e
SHA256

8f74d8dcb94fe2599559dee63511ed67eb75fa47cb8b75104002c4baca0e460e
SHA512

c2742323604eaf97df952e6082b20e747fb19c227670eccab58a2a329a24239577af1bb1454fb29b23cb7f0108a9eee9592deb51b462aa7dfbaba4bb6ec61668
SSDEEP

6144:qt5IG6wZ9AI57tN0rBe6TM05wiBRju4h4/aOnzJRQuMIwy5zn98psF16TrG8PsTu:fYAI+rBjpOUREzLw2f1WrG8HXXQG

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

9cpanel.hackcrack.io:3489

Mutex

Windows Explorer

Attributes

reg_key
Windows Explorer
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
988	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
2676	Setup.exe
2728	Setup.exe
2220	Gorker Private .exe
3056	svchost.exe
1636	explorer.exe
796	explorer.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe
Token: 33	796	explorer.exe
Token: SeIncBasePriorityPrivilege	796	explorer.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2676	2748	GorkerPrivate.exe	31
PID 2748 wrote to memory of 2676	2748	GorkerPrivate.exe	31
PID 2748 wrote to memory of 2676	2748	GorkerPrivate.exe	31
PID 2748 wrote to memory of 2728	2748	GorkerPrivate.exe	32
PID 2748 wrote to memory of 2728	2748	GorkerPrivate.exe	32
PID 2748 wrote to memory of 2728	2748	GorkerPrivate.exe	32
PID 2748 wrote to memory of 2220	2748	GorkerPrivate.exe	33
PID 2748 wrote to memory of 2220	2748	GorkerPrivate.exe	33
PID 2748 wrote to memory of 2220	2748	GorkerPrivate.exe	33
PID 2728 wrote to memory of 3056	2728	Setup.exe	34
PID 2728 wrote to memory of 3056	2728	Setup.exe	34
PID 2728 wrote to memory of 3056	2728	Setup.exe	34
PID 2220 wrote to memory of 2812	2220	Gorker Private .exe	35
PID 2220 wrote to memory of 2812	2220	Gorker Private .exe	35
PID 2220 wrote to memory of 2812	2220	Gorker Private .exe	35
PID 3056 wrote to memory of 1636	3056	svchost.exe	36
PID 3056 wrote to memory of 1636	3056	svchost.exe	36
PID 3056 wrote to memory of 1636	3056	svchost.exe	36
PID 1636 wrote to memory of 796	1636	explorer.exe	37
PID 1636 wrote to memory of 796	1636	explorer.exe	37
PID 1636 wrote to memory of 796	1636	explorer.exe	37
PID 796 wrote to memory of 988	796	explorer.exe	38
PID 796 wrote to memory of 988	796	explorer.exe	38
PID 796 wrote to memory of 988	796	explorer.exe	38

C:\Users\Admin\AppData\Local\Temp\GorkerPrivate.exe
"C:\Users\Admin\AppData\Local\Temp\GorkerPrivate.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:796
      - C:\Windows\system32\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:988
- C:\Users\Admin\AppData\Local\Temp\Gorker Private .exe
  "C:\Users\Admin\AppData\Local\Temp\Gorker Private .exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2220 -s 608
    3⤵
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gorker Private .exe

Filesize
401KB

MD5
55128e0a30d438cb5e4d85beb4d61d4f

SHA1
aa99199ae8d2e1471cb9ec3c8fc1c6cfb355c914

SHA256
2a2e49592f82336a9d1a01fd190bc44e98b3caf17c05c046f06e8d4549d2930b

SHA512
60fedb8c75623fdefd173dae60a1952520699e42acd58b1075303f3d93abad03a1235f19327cfc6204053a29e16ba6a4de14f3e6fc99667a5d0ac75afd283bc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
477KB

MD5
0e6c9432cba1614fccc232f201028c72

SHA1
6082cf9489faa785c066195f108548e705a6d407

SHA256
c9a2faffee3de29e278a89e54b07edb1f520f5e665480a1002d401fd83cde2e8

SHA512
c341000eb6f10c3ee1fb722914abb8ba2e1a3ab32a0ccdd92561c0604d58924699d3f9886b8bd03ab13223c9c78eef74045b181520298dba3323a2809c670abb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
357KB

MD5
cff755ff758e9e71d0af34017a8e9d8e

SHA1
8d401767360e61261cee79a18e061d9a0dc95724

SHA256
c4b3fdf0d7a1dc296560d0ca1f09ce89f3acbcab445fe5fcf5fe908ed3844be2

SHA512
a752a4ed0229cb7ee5a8b0768254f1acb89b1da876a7594952c75cffdb7b7990a45a335332144ae0ff06e0e0dd5e033a89fa29ed2355e2084bcc249e41a73052

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

Filesize
339KB

MD5
301e8d9a2445dd999ce816c17d8dbbb3

SHA1
b91163babeb738bd4d0f577ac764cee17fffe564

SHA256
2ea1fa52a6896ce0100084e3696712d76b4d1e995ca0012954bae3107562a9eb

SHA512
4941a820d26206fa3e333419622c3b07c8ebdaad51d1c6976df912e9ec123ad39a0c67fb5c3e362658f8463b366892fc4575d4cc2ebe62c2011d10ed5eb6bba3

Download Submit
memory/1636-46-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/2220-32-0x0000000001370000-0x00000000013DA000-memory.dmp

Filesize
424KB

Download
memory/2676-26-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/2676-17-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/2728-19-0x00000000003E0000-0x000000000040C000-memory.dmp

Filesize
176KB

Download
memory/2748-12-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/2748-0-0x000007FEF5BCE000-0x000007FEF5BCF000-memory.dmp

Filesize
4KB

Download
memory/2748-18-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/2748-15-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/3056-33-0x0000000000370000-0x0000000000378000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads