Overview

overview

10

Static

static

10

d647158975...3d.exe

windows7-x64

10

d647158975...3d.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6471589756f94a0908a7ec9f0e0e98149882ce6c1cf3da9852dc88fcc3d513d

  • Size

    37KB

  • Sample

    241217-r3lmfs1rbw

  • MD5

    4699bec8cd50aa7f2cecf0df8f0c26a0

  • SHA1

    c7c6c85fc26189cf4c68d45b5f8009a7a456497d

  • SHA256

    d6471589756f94a0908a7ec9f0e0e98149882ce6c1cf3da9852dc88fcc3d513d

  • SHA512

    5701a107e8af1c89574274c8b585ddd87ae88332284fc18090bbcccf5d11b65486ccf70450d4451fec7c75474a62518dd3c5e2bedda98487085276ac51d7ac0e

  • SSDEEP

    768:HXGD2mUbCv/cPDYjM/cA8rM+rMRa8NuEx2t:H2DSbW0rEMUAP+gRJNbx

Score
10/10
njratschooldiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

school

C2

167.71.56.116:22764

Mutex

872de6721af0b6833a743205be97e089

Attributes
  • reg_key

    872de6721af0b6833a743205be97e089

  • splitter

    |'|'|

Targets

    • Target

      d6471589756f94a0908a7ec9f0e0e98149882ce6c1cf3da9852dc88fcc3d513d

    • Size

      37KB

    • MD5

      4699bec8cd50aa7f2cecf0df8f0c26a0

    • SHA1

      c7c6c85fc26189cf4c68d45b5f8009a7a456497d

    • SHA256

      d6471589756f94a0908a7ec9f0e0e98149882ce6c1cf3da9852dc88fcc3d513d

    • SHA512

      5701a107e8af1c89574274c8b585ddd87ae88332284fc18090bbcccf5d11b65486ccf70450d4451fec7c75474a62518dd3c5e2bedda98487085276ac51d7ac0e

    • SSDEEP

      768:HXGD2mUbCv/cPDYjM/cA8rM+rMRa8NuEx2t:H2DSbW0rEMUAP+gRJNbx

    Score
    10/10
    njratschooldiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks