njrat | 901d3914e57588b3cabe641fc1b46ab7416b79f3019e5231bef789013f331e8a

General

Target

Nordvpn Checker by xRisky/NordVPN Checker .exe
Size

1.0MB
MD5

395c953449cf3bb03a51a78844417ad0
SHA1

731ed26c2d6509f6f7f20dc9712a23b21e6a6283
SHA256

1dc2c6e80ec0e26096859319907b456a505979b4931c6bb369f77acf69e940a2
SHA512

b1c251d2e96dd5e6fa8e6ae4924c941dd473e6452ac6a931f273b350c68c7ebb5e64f4f2e89d4504e5eb485a43619f72eaa5936e0c33d84b318fc8709f0ad957
SSDEEP

24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaaM7c6+Ea75W:ph+ZkldoPK8YaaLW

Score

10^/10

njrat checker 2alpes discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Checker 2alpes

C2

pur3vpn.ddns.net:5559

Mutex

bfb7b23723ac9ef23fe5ca9d03794c39

Attributes

reg_key
bfb7b23723ac9ef23fe5ca9d03794c39
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4440	netsh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NordVPN Checker .exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 4112	1628	NordVPN Checker .exe	78

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NordVPN Checker .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NordVPN Checker .exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NordVPN Checker .exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	NordVPN Checker .exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Nordvpn Checker by xRisky\winmgmts:\root\cimv2	NordVPN Checker .exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	RegAsm.exe
Token: 33	4112	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4112	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4112	1628	NordVPN Checker .exe	78
PID 1628 wrote to memory of 4112	1628	NordVPN Checker .exe	78
PID 1628 wrote to memory of 4112	1628	NordVPN Checker .exe	78
PID 1628 wrote to memory of 4112	1628	NordVPN Checker .exe	78
PID 1628 wrote to memory of 4112	1628	NordVPN Checker .exe	78
PID 4112 wrote to memory of 4440	4112	RegAsm.exe	79
PID 4112 wrote to memory of 4440	4112	RegAsm.exe	79
PID 4112 wrote to memory of 4440	4112	RegAsm.exe	79

C:\Users\Admin\AppData\Local\Temp\Nordvpn Checker by xRisky\NordVPN Checker .exe
"C:\Users\Admin\AppData\Local\Temp\Nordvpn Checker by xRisky\NordVPN Checker .exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-0-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/4112-1-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/4112-6-0x0000000073451000-0x0000000073452000-memory.dmp

Filesize
4KB

Download
memory/4112-7-0x0000000073450000-0x0000000073A01000-memory.dmp

Filesize
5.7MB

Download
memory/4112-8-0x0000000073450000-0x0000000073A01000-memory.dmp

Filesize
5.7MB

Download
memory/4112-9-0x0000000073450000-0x0000000073A01000-memory.dmp

Filesize
5.7MB

Download
memory/4112-10-0x0000000073450000-0x0000000073A01000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads