njrat | 050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a

General

Target

050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe
Size

591KB
MD5

78f7f36c5429a9713461f2a6fc90b7ef
SHA1

6245684437ff0c09ec06d3c93fe2a3dd1c89d643
SHA256

050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a
SHA512

95bea0141219f97abf3719a498a6da1fe0582dda1f45027ea3ea84e1c853e81d2b8c5f2b26485d12911b0215fa5c58a23725077ca03ee4d58eb0c5f1343081cd
SSDEEP

6144:lHagJcX+kTQvQDfQFkw01BJWJP98V24rIl3PafNSINywRtF/NZAWP6gH1z7OStKp:1cO3QDPBMJKVO/afzNywRt5NmY6Ek

Score

10^/10

njrat discovery trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe

Executes dropped EXE 2 IoCs

pid	Process
4828	paysad.exe
3704	paysad.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 880 set thread context of 3168	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	82
PID 4828 set thread context of 3704	4828	paysad.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	3704	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	paysad.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe
Token: SeDebugPrivilege	4828	paysad.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3704	paysad.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3168	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	82
PID 880 wrote to memory of 3168	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	82
PID 880 wrote to memory of 3168	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	82
PID 880 wrote to memory of 3168	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	82
PID 880 wrote to memory of 3168	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	82
PID 880 wrote to memory of 3168	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	82
PID 880 wrote to memory of 3168	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	82
PID 880 wrote to memory of 3168	880	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	82
PID 3168 wrote to memory of 4828	3168	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	83
PID 3168 wrote to memory of 4828	3168	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	83
PID 3168 wrote to memory of 4828	3168	050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe	83
PID 4828 wrote to memory of 3704	4828	paysad.exe	84
PID 4828 wrote to memory of 3704	4828	paysad.exe	84
PID 4828 wrote to memory of 3704	4828	paysad.exe	84
PID 4828 wrote to memory of 3704	4828	paysad.exe	84
PID 4828 wrote to memory of 3704	4828	paysad.exe	84
PID 4828 wrote to memory of 3704	4828	paysad.exe	84
PID 4828 wrote to memory of 3704	4828	paysad.exe	84
PID 4828 wrote to memory of 3704	4828	paysad.exe	84

C:\Users\Admin\AppData\Local\Temp\050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe
"C:\Users\Admin\AppData\Local\Temp\050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe
  C:\Users\Admin\AppData\Local\Temp\050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Users\Admin\AppData\Local\Temp\paysad.exe
    "C:\Users\Admin\AppData\Local\Temp\paysad.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\paysad.exe
      C:\Users\Admin\AppData\Local\Temp\paysad.exe
      4⤵
      Executes dropped EXE
      Suspicious use of UnmapMainImage
      PID:3704
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 12
        5⤵
        Program crash
        
        PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 3704
1⤵
PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a.exe.log

Filesize
493B

MD5
d62af200a730a61158601c4c3722811e

SHA1
e9e49b90a2b3480bebd81e24fa365235b7d42a63

SHA256
d4dd21b1143f31375ae154aca062e2534952fcd5dc19160dd2af3bbb1c5a2438

SHA512
d2cd527cf6b7b5a2a9eb3f888b29927ff9add8e9493bd58837f12c23bcd16237399ab48b8b9fddfca21e1002b0aa9053aaaef7a50ababafc21968a1c01af9647

Download Submit
C:\Users\Admin\AppData\Local\Temp\paysad.exe

Filesize
591KB

MD5
78f7f36c5429a9713461f2a6fc90b7ef

SHA1
6245684437ff0c09ec06d3c93fe2a3dd1c89d643

SHA256
050a09473b63d1fd05f3536cd6394a5cda468d77e16fdabd3c8dc0787530972a

SHA512
95bea0141219f97abf3719a498a6da1fe0582dda1f45027ea3ea84e1c853e81d2b8c5f2b26485d12911b0215fa5c58a23725077ca03ee4d58eb0c5f1343081cd

Download Submit
memory/880-0-0x0000000074962000-0x0000000074963000-memory.dmp

Filesize
4KB

Download
memory/880-1-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/880-2-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/880-7-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/3168-3-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3168-8-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/3168-9-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/3168-20-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/4828-21-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download
memory/4828-25-0x0000000074960000-0x0000000074F11000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing