njrat | 03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15

General

Target

03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe
Size

3.3MB
MD5

2a250a987df95bf6db01ad711217ed20
SHA1

29a22aaec7b36e6e074367025861e1fa5f42682b
SHA256

03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15
SHA512

15d767edecdf3971c344e3aefdbcafefee0f5568d75b96c436b9737c7ac20308b2f34decf96dea59d8515b1e6c8dc91e003bee73aab467643b3243679b1f3f65
SSDEEP

98304:zKBLb+F+m/3LPP5xNd5BS0f0qd3EHsK5ajbejg:z6LQJLPh159ld3q58r

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

984559f52d4087243e95e5ad9bb48e8d

Attributes

reg_key
984559f52d4087243e95e5ad9bb48e8d
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2964	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\984559f52d4087243e95e5ad9bb48e8d.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\984559f52d4087243e95e5ad9bb48e8d.exe	server.exe

Executes dropped EXE 4 IoCs

pid	Process
2164	Encrypted.exe
2812	CDS.exe
2924	crypted.exe
2588	server.exe

Loads dropped DLL 7 IoCs

pid	Process
2164	Encrypted.exe
2812	CDS.exe
2812	CDS.exe
2812	CDS.exe
2812	CDS.exe
2812	CDS.exe
2924	crypted.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Encrypted.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\984559f52d4087243e95e5ad9bb48e8d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\984559f52d4087243e95e5ad9bb48e8d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_259556865	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe
File created	C:\Windows\Encrypted.exe	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe
File opened for modification	C:\Windows\Encrypted.exe	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Encrypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CDS.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2812	CDS.exe
2812	CDS.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2396	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe
Token: SeRestorePrivilege	2396	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe
Token: 33	2820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2820	AUDIODG.EXE
Token: 33	2820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2820	AUDIODG.EXE
Token: SeDebugPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe
Token: 33	2588	server.exe
Token: SeIncBasePriorityPrivilege	2588	server.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	CDS.exe
2812	CDS.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2164	2396	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe	29
PID 2396 wrote to memory of 2164	2396	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe	29
PID 2396 wrote to memory of 2164	2396	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe	29
PID 2396 wrote to memory of 2164	2396	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe	29
PID 2396 wrote to memory of 2164	2396	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe	29
PID 2396 wrote to memory of 2164	2396	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe	29
PID 2396 wrote to memory of 2164	2396	03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe	29
PID 2164 wrote to memory of 2812	2164	Encrypted.exe	30
PID 2164 wrote to memory of 2812	2164	Encrypted.exe	30
PID 2164 wrote to memory of 2812	2164	Encrypted.exe	30
PID 2164 wrote to memory of 2812	2164	Encrypted.exe	30
PID 2812 wrote to memory of 2924	2812	CDS.exe	32
PID 2812 wrote to memory of 2924	2812	CDS.exe	32
PID 2812 wrote to memory of 2924	2812	CDS.exe	32
PID 2812 wrote to memory of 2924	2812	CDS.exe	32
PID 2924 wrote to memory of 2588	2924	crypted.exe	33
PID 2924 wrote to memory of 2588	2924	crypted.exe	33
PID 2924 wrote to memory of 2588	2924	crypted.exe	33
PID 2924 wrote to memory of 2588	2924	crypted.exe	33
PID 2588 wrote to memory of 2964	2588	server.exe	34
PID 2588 wrote to memory of 2964	2588	server.exe	34
PID 2588 wrote to memory of 2964	2588	server.exe	34
PID 2588 wrote to memory of 2964	2588	server.exe	34

C:\Users\Admin\AppData\Local\Temp\03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe
"C:\Users\Admin\AppData\Local\Temp\03540223fcf6bc801de1f4ef026e0f1d6de19967fa94768c0c01b5dd4cfa3a15N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\Encrypted.exe
  "C:\Windows\Encrypted.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\server.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2588
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x530
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.png

Filesize
2KB

MD5
340b294efc691d1b20c64175d565ebc7

SHA1
81cb9649bd1c9a62ae79e781818fc24d15c29ce7

SHA256
72566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9

SHA512
1395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cdd

Filesize
13KB

MD5
3e7ecaeb51c2812d13b07ec852d74aaf

SHA1
e9bdab93596ffb0f7f8c65243c579180939acb26

SHA256
e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96

SHA512
635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.dat

Filesize
30KB

MD5
17d8458e3c8df344c17e461852651060

SHA1
2646d755e21ae9a9b940537904033801c3ed5cc8

SHA256
3f10a057fd34b70d4c006bdd869ba2cf1c753b45b0042d45bcf4d49387b025f2

SHA512
f65f313372bc29a5992907a991265b84b4098e9917bd0b11d5d2672742caf4bd97f41f2d26954e07b9cea4e7e30cf4ed6d892dc6a1d10c8bfd8d5b1142e1ae95

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settings

Filesize
5B

MD5
68934a3e9455fa72420237eb05902327

SHA1
7cb6efb98ba5972a9b5090dc2e517fe14d12cb04

SHA256
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

SHA512
719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll

Filesize
322KB

MD5
c3256800dce47c14acc83ccca4c3e2ac

SHA1
9d126818c66991dbc3813a65eddb88bbcf77f30a

SHA256
f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866

SHA512
6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25

Download Submit
C:\Windows\Encrypted.exe

Filesize
3.2MB

MD5
c9f50701d5e5b6c42e6eb4295e4d90cb

SHA1
e40000ed39200bf32cf2103ebf9b0ce007b8b079

SHA256
8b6c39d88e65be1986549a25b0cca4e706bd08f8be374600e58bd5f4555971a2

SHA512
9230e569b0e2d948cd9c3565a3f8345d087ef1d4bfa7570e3b25360d1957ef50c7cbcca6bb3341308a9031686b9d3b4860184bfb5a631003be8be0c253501f7c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe

Filesize
6.1MB

MD5
424bf196deaeb4ddcafb78e137fa560a

SHA1
007738e9486c904a3115daa6e8ba2ee692af58c8

SHA256
0963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2

SHA512
a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe

Filesize
30KB

MD5
d810fa4858efe313701ac797fabf01bb

SHA1
217faab9cf2e375fe32ef53c41fcb34089f558f9

SHA256
ea5fcc04fe8d7a3001e128db8031e81884c0b71858fc21d4487b13d258f94cdd

SHA512
83892ee085dde1b35d5512058d32d2e288366bd66d3d65cb1e0162b75cf69c201a7e085b7285a1b80782587bb9ce724727255fb203af40bcd20c6c8ab9214676

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads