njrat | 812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe
Size

37KB
MD5

3868437c16370a8ad9e3b5aeb4c6fa08
SHA1

2e4d638e5331d13661f4a7117a06c085b3cbfa6e
SHA256

812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101
SHA512

42530865557f6b0d9d624dba31da722ae858a8614ee8455f5f6be65d660432ba8b6c80dea6234172c085c88a69329719c4f6b2b847dc49e310b756b2903c2ba6
SSDEEP

384:kN4jjcXCisJfcR9L5YXyc/uSfMVkzHV2bItnCer6rAF+rMRTyN/0L+Ecoinblnef:S4+j5Yic/BhUI4e2rM+rMRa8Nu0CntQ

Score

10^/10

njrat gay nigger discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

GAY NIGGER

times-sig.gl.at.ply.gg:51482

Mutex

866df5bb46da1e7f608869955f1d1862

Attributes

reg_key
866df5bb46da1e7f608869955f1d1862
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2912	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\866df5bb46da1e7f608869955f1d1862.exe	COM Surrogate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\866df5bb46da1e7f608869955f1d1862.exe	COM Surrogate.exe

Executes dropped EXE 1 IoCs

pid	Process
2764	COM Surrogate.exe

Loads dropped DLL 1 IoCs

pid	Process
308	812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\866df5bb46da1e7f608869955f1d1862 = "\"C:\\ProgramData\\COM Surrogate.exe\" .."	COM Surrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\866df5bb46da1e7f608869955f1d1862 = "\"C:\\ProgramData\\COM Surrogate.exe\" .."	COM Surrogate.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	COM Surrogate.exe
File created	C:\autorun.inf	COM Surrogate.exe
File opened for modification	C:\autorun.inf	COM Surrogate.exe
File created	D:\autorun.inf	COM Surrogate.exe
File created	F:\autorun.inf	COM Surrogate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COM Surrogate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3044	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe
2764	COM Surrogate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	COM Surrogate.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	COM Surrogate.exe
Token: SeDebugPrivilege	3044	taskkill.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe
Token: 33	2764	COM Surrogate.exe
Token: SeIncBasePriorityPrivilege	2764	COM Surrogate.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2764	308	812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe	30
PID 308 wrote to memory of 2764	308	812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe	30
PID 308 wrote to memory of 2764	308	812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe	30
PID 308 wrote to memory of 2764	308	812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe	30
PID 2764 wrote to memory of 2912	2764	COM Surrogate.exe	31
PID 2764 wrote to memory of 2912	2764	COM Surrogate.exe	31
PID 2764 wrote to memory of 2912	2764	COM Surrogate.exe	31
PID 2764 wrote to memory of 2912	2764	COM Surrogate.exe	31
PID 2764 wrote to memory of 3044	2764	COM Surrogate.exe	33
PID 2764 wrote to memory of 3044	2764	COM Surrogate.exe	33
PID 2764 wrote to memory of 3044	2764	COM Surrogate.exe	33
PID 2764 wrote to memory of 3044	2764	COM Surrogate.exe	33

C:\Users\Admin\AppData\Local\Temp\812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe
"C:\Users\Admin\AppData\Local\Temp\812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:308
- C:\ProgramData\COM Surrogate.exe
  "C:\ProgramData\COM Surrogate.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\ProgramData\COM Surrogate.exe" "COM Surrogate.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\COM Surrogate.exe

Filesize
37KB

MD5
3868437c16370a8ad9e3b5aeb4c6fa08

SHA1
2e4d638e5331d13661f4a7117a06c085b3cbfa6e

SHA256
812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101

SHA512
42530865557f6b0d9d624dba31da722ae858a8614ee8455f5f6be65d660432ba8b6c80dea6234172c085c88a69329719c4f6b2b847dc49e310b756b2903c2ba6

Download Submit
memory/308-0-0x0000000074D91000-0x0000000074D92000-memory.dmp

Filesize
4KB

Download
memory/308-1-0x0000000074D90000-0x000000007533B000-memory.dmp

Filesize
5.7MB

Download
memory/308-2-0x0000000074D90000-0x000000007533B000-memory.dmp

Filesize
5.7MB

Download
memory/308-10-0x0000000074D90000-0x000000007533B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-11-0x0000000074D90000-0x000000007533B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-12-0x0000000074D90000-0x000000007533B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-22-0x0000000074D90000-0x000000007533B000-memory.dmp

Filesize
5.7MB

Download