Overview

overview

10

Static

static

3

352336c4bc...d8.exe

windows7-x64

10

352336c4bc...d8.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-12-2024 01:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    352336c4bc2f0db999e86abb065598d8.exe

  • Size

    3.1MB

  • MD5

    352336c4bc2f0db999e86abb065598d8

  • SHA1

    5ae135912754c2348460fa4ce221d637de1a36e4

  • SHA256

    7af46e45bdbb2d1b9731841c5c9000c7635b7d9d59e8e3e32508fe202d6132ba

  • SHA512

    f75208ec26a0843fad754c68fbebc3b02b944690627e20fbb9b3ae4ae971a369a29c36f074039a44f48a26be24b41352c5bd4b996d0f3c4bbc9896b69bde538e

  • SSDEEP

    49152:AHD9PlCsjRnB8Bc4GNFq3GoTapL8Fa75/XlkEQGfSk0oJ0wnnrT3:kZPlpnmBc4GNoXTa8aVdkEQK38wH3

Score
10/10
njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

45.83.207.236:5552

Mutex

c932779fadb451b44351b10e6e56bf73

Attributes
  • reg_key

    c932779fadb451b44351b10e6e56bf73

  • splitter

    |'|'|

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 5 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\352336c4bc2f0db999e86abb065598d8.exe
    "C:\Users\Admin\AppData\Local\Temp\352336c4bc2f0db999e86abb065598d8.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Users\Admin\AppData\Local\Temp\Happy new - .exe
      "C:\Users\Admin\AppData\Local\Temp\Happy new - .exe"
      2⤵
      • Executes dropped EXE
      PID:2816
    • C:\Users\Admin\AppData\Local\Temp\Pakg.exe
      "C:\Users\Admin\AppData\Local\Temp\Pakg.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Users\Admin\UserOOBEBroker.exe
        "C:\Users\Admin\UserOOBEBroker.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops autorun.inf file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\UserOOBEBroker.exe" "UserOOBEBroker.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2984
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM Exsample.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Pakg.exe
    Filesize

    37KB

    MD5

    67931560029cc67967f024e3c42c107a

    SHA1

    fed599a8ee2a821e9f93109d1e660118ff3f0451

    SHA256

    99e3e8a30f946770b612f530e63f0448d4e0dc261d165918b09abd2dd67d08c3

    SHA512

    85a9a9735e3ba7693ee3d01b808929e48e0ca7d03762ef54a1024ae89238d992310a575fd5c429c62cb2030732dd25033c1ce71e0320c196fd755d62f1c47a96

    Download Submit

  • \Users\Admin\AppData\Local\Temp\Happy new - .exe
    Filesize

    12.0MB

    MD5

    c6bd70a2120cc3746df3ba4bce4fe00a

    SHA1

    91ab9936cf0ec1ec586cc6630c7d1cab6945367d

    SHA256

    9474d988fb6b33f021ca2c9f2dad18d1a0d3b48c9249d8f94465f81bba4154fa

    SHA512

    dd489a0459e3d41fbb5bd727add9d64deb209c433eddc5e9b2e2d2a2c0cbca7a3ebeae83ad2452a5490c303eae9eade2d9e0e6494591ef0c548f9035fb07b568

    Download Submit