njrat | 391d3357c3e07d6444f6cd189f68d748c52444c30d3dd68282c50acf62e5db72

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4a07f7612b822a1c6e6879ba5dcc5de.exe
Size

209KB
MD5

c4a07f7612b822a1c6e6879ba5dcc5de
SHA1

09d44c896d14e7df8d8da0d938235ee33c9b2281
SHA256

391d3357c3e07d6444f6cd189f68d748c52444c30d3dd68282c50acf62e5db72
SHA512

27c07202d83ac4593e1f734480f735e2b4d02bac4646211756eb852267aff8c1acbe974161c93ac6baf1981ad669b5a30f4d320bc26f4f1d1e71b2ed1dc90058
SSDEEP

3072:rR2EJHNNObrQy5y6GrEHBAnpK37nX9840BQ5f74tyJhcMKNFhHF+bs5iRXr:124NMbrQy7L8c0Fpgs5iJ

Score

10^/10

njrat byabolhb trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

ByABOLHB

abolhb.com:505

Mutex

165d6ed988ac

Attributes

reg_key
165d6ed988ac
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
1960	MicrosoftEdgeUpdateTaskMachineUAC.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1960	MicrosoftEdgeUpdateTaskMachineUAC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	c4a07f7612b822a1c6e6879ba5dcc5de.exe
Token: SeBackupPrivilege	2864	vssvc.exe
Token: SeRestorePrivilege	2864	vssvc.exe
Token: SeAuditPrivilege	2864	vssvc.exe
Token: SeDebugPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: SeIncBasePriorityPrivilege	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe
Token: 33	1960	MicrosoftEdgeUpdateTaskMachineUAC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1960	1408	taskeng.exe	35
PID 1408 wrote to memory of 1960	1408	taskeng.exe	35
PID 1408 wrote to memory of 1960	1408	taskeng.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c4a07f7612b822a1c6e6879ba5dcc5de.exe
"C:\Users\Admin\AppData\Local\Temp\c4a07f7612b822a1c6e6879ba5dcc5de.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\system32\taskeng.exe
taskeng.exe {39F21C32-28D4-4034-8493-A39C3E5D0454} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdateTaskMachineUAC.exe
  C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdateTaskMachineUAC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdateTaskMachineUAC.exe

Filesize
209KB

MD5
c4a07f7612b822a1c6e6879ba5dcc5de

SHA1
09d44c896d14e7df8d8da0d938235ee33c9b2281

SHA256
391d3357c3e07d6444f6cd189f68d748c52444c30d3dd68282c50acf62e5db72

SHA512
27c07202d83ac4593e1f734480f735e2b4d02bac4646211756eb852267aff8c1acbe974161c93ac6baf1981ad669b5a30f4d320bc26f4f1d1e71b2ed1dc90058

Download Submit
memory/1960-10-0x0000000000A90000-0x0000000000ACA000-memory.dmp

Filesize
232KB

Download
memory/1960-11-0x00000000006E0000-0x00000000006EC000-memory.dmp

Filesize
48KB

Download
memory/2464-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2464-1-0x0000000000200000-0x000000000023A000-memory.dmp

Filesize
232KB

Download
memory/2464-2-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2464-5-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2464-6-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download