njrat | e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554

General

Target

e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe
Size

591KB
MD5

7ad563d1d370af1e8d8e5b6cb5d8ce00
SHA1

066d80afc7a9ec1d9f9132973c130e134757e4d8
SHA256

e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554
SHA512

06f2fb0f30cbb15a46f4a414eff01db68f9a820a4ad6a0b1f93f61290cef9e6e3ad16c7277ea4d0976e607c80fc5ffc6a30b81abc4d5a51657a458fb8ed75d6f
SSDEEP

6144:lHagJcX+kTQvQDfQFkw01BJWJP98V24rIl3PafNSINywRtF/NZAWP6gH1z7OStK:1cO3QDPBMJKVO/afzNywRt5NmY6E

Score

10^/10

njrat discovery trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe

Executes dropped EXE 2 IoCs

pid	Process
632	paysad.exe
1496	paysad.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 2044	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	83
PID 632 set thread context of 1496	632	paysad.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	1496	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	paysad.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe
Token: SeDebugPrivilege	632	paysad.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2044	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	83
PID 1792 wrote to memory of 2044	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	83
PID 1792 wrote to memory of 2044	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	83
PID 1792 wrote to memory of 2044	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	83
PID 1792 wrote to memory of 2044	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	83
PID 1792 wrote to memory of 2044	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	83
PID 1792 wrote to memory of 2044	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	83
PID 1792 wrote to memory of 2044	1792	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	83
PID 2044 wrote to memory of 632	2044	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	84
PID 2044 wrote to memory of 632	2044	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	84
PID 2044 wrote to memory of 632	2044	e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe	84
PID 632 wrote to memory of 1496	632	paysad.exe	85
PID 632 wrote to memory of 1496	632	paysad.exe	85
PID 632 wrote to memory of 1496	632	paysad.exe	85
PID 632 wrote to memory of 1496	632	paysad.exe	85
PID 632 wrote to memory of 1496	632	paysad.exe	85
PID 632 wrote to memory of 1496	632	paysad.exe	85
PID 632 wrote to memory of 1496	632	paysad.exe	85
PID 632 wrote to memory of 1496	632	paysad.exe	85

C:\Users\Admin\AppData\Local\Temp\e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe
"C:\Users\Admin\AppData\Local\Temp\e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe
  C:\Users\Admin\AppData\Local\Temp\e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\paysad.exe
    "C:\Users\Admin\AppData\Local\Temp\paysad.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Users\Admin\AppData\Local\Temp\paysad.exe
      C:\Users\Admin\AppData\Local\Temp\paysad.exe
      4⤵
      Executes dropped EXE
      PID:1496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 80
        5⤵
        Program crash
        
        PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1496 -ip 1496
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554N.exe.log

Filesize
493B

MD5
d62af200a730a61158601c4c3722811e

SHA1
e9e49b90a2b3480bebd81e24fa365235b7d42a63

SHA256
d4dd21b1143f31375ae154aca062e2534952fcd5dc19160dd2af3bbb1c5a2438

SHA512
d2cd527cf6b7b5a2a9eb3f888b29927ff9add8e9493bd58837f12c23bcd16237399ab48b8b9fddfca21e1002b0aa9053aaaef7a50ababafc21968a1c01af9647

Download Submit
C:\Users\Admin\AppData\Local\Temp\paysad.exe

Filesize
591KB

MD5
7ad563d1d370af1e8d8e5b6cb5d8ce00

SHA1
066d80afc7a9ec1d9f9132973c130e134757e4d8

SHA256
e617b6f2693165f8d2def1bc6da8f614654ce49383170fdca1891da85d333554

SHA512
06f2fb0f30cbb15a46f4a414eff01db68f9a820a4ad6a0b1f93f61290cef9e6e3ad16c7277ea4d0976e607c80fc5ffc6a30b81abc4d5a51657a458fb8ed75d6f

Download Submit
memory/632-21-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/632-26-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/632-22-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/1792-1-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/1792-2-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/1792-7-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/1792-0-0x0000000074882000-0x0000000074883000-memory.dmp

Filesize
4KB

Download
memory/2044-8-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/2044-20-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/2044-9-0x0000000074880000-0x0000000074E31000-memory.dmp

Filesize
5.7MB

Download
memory/2044-3-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing