njrat | 21a76a566962c21072555e4bb5121349968ca8e5a4a459b8c628f50be8edb549

Analysis

max time kernel
210s
max time network
210s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
14-01-2025 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hazem pro.exe
Size

1.3MB
MD5

9d399494a5edab7861687db8301165ee
SHA1

939172bd2056b077375daf57bdc3227688c0174f
SHA256

21a76a566962c21072555e4bb5121349968ca8e5a4a459b8c628f50be8edb549
SHA512

b4c66b06ddd3b3dd759643769b062f6f021204d7ab6e7605da9d8ba92e62664a672e2f79cbbdb0ac120bf89f30b717cb6920dfa9ca170dd7c7000c47553f916c
SSDEEP

24576:Pnzkt2a4f25l9otyOiAifrtx5V3S7KS9ZIUK5HKeKYjFXXTmVGWVRDnORAQ7iE:ryW+5otyOaDtx5V3VS/hK5qleXXTmL3k

Score

10^/10

njrat تم الاختراق بواسطا احمد السيسي discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

تم الاختراق بواسطا احمد السيسي

maestro49.ddns.net:5552

Mutex

5f137ae7d0d66d9b5cded8a570234747

Attributes

reg_key
5f137ae7d0d66d9b5cded8a570234747
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
928	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation	Hazem pro.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5f137ae7d0d66d9b5cded8a570234747.exe	OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5f137ae7d0d66d9b5cded8a570234747.exe	OneDrive.exe

Executes dropped EXE 2 IoCs

pid	Process
4008	OneDrive.exe
444	Hazem pro.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5f137ae7d0d66d9b5cded8a570234747 = "\"C:\\Users\\Admin\\AppData\\Roaming\\OneDrive.exe\" .."	OneDrive.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5f137ae7d0d66d9b5cded8a570234747 = "\"C:\\Users\\Admin\\AppData\\Roaming\\OneDrive.exe\" .."	OneDrive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hazem pro.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe
4008	OneDrive.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4008	OneDrive.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: 33	2592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2592	AUDIODG.EXE
Token: SeDebugPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe
Token: 33	4008	OneDrive.exe
Token: SeIncBasePriorityPrivilege	4008	OneDrive.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 4008	380	Hazem pro.exe	80
PID 380 wrote to memory of 4008	380	Hazem pro.exe	80
PID 380 wrote to memory of 444	380	Hazem pro.exe	81
PID 380 wrote to memory of 444	380	Hazem pro.exe	81
PID 380 wrote to memory of 444	380	Hazem pro.exe	81
PID 4008 wrote to memory of 928	4008	OneDrive.exe	84
PID 4008 wrote to memory of 928	4008	OneDrive.exe	84

C:\Users\Admin\AppData\Local\Temp\Hazem pro.exe
"C:\Users\Admin\AppData\Local\Temp\Hazem pro.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SYSTEM32\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\OneDrive.exe" "OneDrive.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:928
- C:\Users\Admin\AppData\Roaming\Hazem pro.exe
  "C:\Users\Admin\AppData\Roaming\Hazem pro.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3dc 0x4a4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Hazem pro.exe

Filesize
549KB

MD5
b896198c117a77a965f3b6a5d1d58f3d

SHA1
5f51edee59a2858e2b830cab8a86a37952a995c2

SHA256
51136630c2cff9f8fce660c89a5a81409ad6fddfebcc5fefdfaea21040fa020b

SHA512
ccbba8e6a573ff0e461afb5f22d7a3bb8e03c43caa71d685a906d8b32f82b9367ce34de9731ed4fcb2494d6f1a6fd06f3f46f4f84f40ea485d3761110e878ab0

Download Submit
C:\Users\Admin\AppData\Roaming\OneDrive.exe

Filesize
785KB

MD5
3bb4bcf94cbdc788e8f6cf4d38be466f

SHA1
ec15d0cdc8f5f021b0c0e3d3b09a9ea8a1012545

SHA256
96a4a6b8b82eacb3f6e6735462a13a79f24237a78fe40158c36f7271ba232347

SHA512
ef43eb5c02da4236d7876a096a73341415e4311f4460ab7583f776e443ef247c575ce8014ad58d75781e36728ba19169265ad08181b6b3b48e39a00676b7e00b

Download Submit
memory/380-0-0x00007FFD53AD3000-0x00007FFD53AD5000-memory.dmp

Filesize
8KB

Download
memory/380-1-0x0000000000C50000-0x0000000000DAA000-memory.dmp

Filesize
1.4MB

Download
memory/444-45-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/444-43-0x0000000001980000-0x0000000001990000-memory.dmp

Filesize
64KB

Download
memory/444-44-0x0000000074CA2000-0x0000000074CA4000-memory.dmp

Filesize
8KB

Download
memory/444-34-0x0000000001980000-0x0000000001990000-memory.dmp

Filesize
64KB

Download
memory/444-35-0x0000000074CA2000-0x0000000074CA4000-memory.dmp

Filesize
8KB

Download
memory/444-38-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/4008-37-0x000000001C510000-0x000000001C5B6000-memory.dmp

Filesize
664KB

Download
memory/4008-39-0x00007FFD504A5000-0x00007FFD504A6000-memory.dmp

Filesize
4KB

Download
memory/4008-36-0x000000001C3C0000-0x000000001C45C000-memory.dmp

Filesize
624KB

Download
memory/4008-40-0x00000000013C0000-0x00000000013C8000-memory.dmp

Filesize
32KB

Download
memory/4008-41-0x000000001CA20000-0x000000001CA6C000-memory.dmp

Filesize
304KB

Download
memory/4008-42-0x00007FFD501F0000-0x00007FFD50B91000-memory.dmp

Filesize
9.6MB

Download
memory/4008-32-0x000000001BEF0000-0x000000001C3BE000-memory.dmp

Filesize
4.8MB

Download
memory/4008-33-0x00007FFD501F0000-0x00007FFD50B91000-memory.dmp

Filesize
9.6MB

Download
memory/4008-30-0x00007FFD504A5000-0x00007FFD504A6000-memory.dmp

Filesize
4KB

Download
memory/4008-46-0x000000001C790000-0x000000001C7A0000-memory.dmp

Filesize
64KB

Download