njrat | 578bd705fdf85e864f09780e885c2a04305a719038b66b2ff5639bf2572600de | Triage

Sharing

General

Target

a.exe
Size

165KB
Sample

241220-t9tmrazrfk
MD5

ab291dfdae1f44bd81ec75de9dd657d6
SHA1

3cfca0456d8037e9759bce00991bd06d6dab8c86
SHA256

578bd705fdf85e864f09780e885c2a04305a719038b66b2ff5639bf2572600de
SHA512

71239480308c81ff5f4cde60cb54d05e37cb966ed276dd01cd70536728474d5f412aada83504890c065b6e34ff354fc5920f12b9ccd9a11875711fcffffc5cea
SSDEEP

3072:fP8VpD/T68Q8wsWMS1kDGo/JzlJCFEw2iNb0Zr15bO:fP8V2f1k7/JBYW/ebmO

Score

10^/10

njrat discovery persistence

Malware Config

Targets

- Target
  
  a.exe
- Size
  
  165KB
- MD5
  
  ab291dfdae1f44bd81ec75de9dd657d6
- SHA1
  
  3cfca0456d8037e9759bce00991bd06d6dab8c86
- SHA256
  
  578bd705fdf85e864f09780e885c2a04305a719038b66b2ff5639bf2572600de
- SHA512
  
  71239480308c81ff5f4cde60cb54d05e37cb966ed276dd01cd70536728474d5f412aada83504890c065b6e34ff354fc5920f12b9ccd9a11875711fcffffc5cea
- SSDEEP
  
  3072:fP8VpD/T68Q8wsWMS1kDGo/JzlJCFEw2iNb0Zr15bO:fP8V2f1k7/JBYW/ebmO
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence