Overview

overview

10

Static

static

10

bf6a3c9e2f...30.exe

windows7-x64

10

bf6a3c9e2f...30.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf6a3c9e2fc15c686a58e2d146a7518e7484b51372dd432a5863bae057623330.exe

  • Size

    37KB

  • Sample

    241217-e3lw1a1qel

  • MD5

    0a09aa08c401a1c24b8fb8535e16e25a

  • SHA1

    1fc2e9207b54d49c74e9fd3e833cd1dc088022d2

  • SHA256

    bf6a3c9e2fc15c686a58e2d146a7518e7484b51372dd432a5863bae057623330

  • SHA512

    4b4dddb99654be87304a1b1542098c82f95f3f8c35a1d1b19a8a014b29713fb37e87dabc5f24a53d10203b36bd4f9552e97f812951477975ae613d8ea6db1427

  • SSDEEP

    384:hSNBkiy5nDNGRn5IyUvgI1P9h4/C254crAF+rMRTyN/0L+EcoinblneHQM3epzXJ:4O5M5jUv11wq2+crM+rMRa8NuCbet

Score
10/10
njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Hacked

C2

wbouchraros.theworkpc.com:5552

Mutex

636e3f8f7cbfc871c59e6d158a287b2f

Attributes
  • reg_key

    636e3f8f7cbfc871c59e6d158a287b2f

  • splitter

    |'|'|

Targets

    • Target

      bf6a3c9e2fc15c686a58e2d146a7518e7484b51372dd432a5863bae057623330.exe

    • Size

      37KB

    • MD5

      0a09aa08c401a1c24b8fb8535e16e25a

    • SHA1

      1fc2e9207b54d49c74e9fd3e833cd1dc088022d2

    • SHA256

      bf6a3c9e2fc15c686a58e2d146a7518e7484b51372dd432a5863bae057623330

    • SHA512

      4b4dddb99654be87304a1b1542098c82f95f3f8c35a1d1b19a8a014b29713fb37e87dabc5f24a53d10203b36bd4f9552e97f812951477975ae613d8ea6db1427

    • SSDEEP

      384:hSNBkiy5nDNGRn5IyUvgI1P9h4/C254crAF+rMRTyN/0L+EcoinblneHQM3epzXJ:4O5M5jUv11wq2+crM+rMRa8NuCbet

    Score
    10/10
    njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks