njrat | cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d

Analysis

max time kernel
149s
max time network
147s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
22-01-2025 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Project 1.exe
Size

7.0MB
MD5

b97c8aab67e949a5e43905ceed9b0319
SHA1

5b9f0aa33a1e4e325370711d950fdf06b737993f
SHA256

cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d
SHA512

e2c3a1773859c6e76a1dc155593ff96983cd1d499c4e9e3ff732027167d81b484c0d774652a7486e778b66b7abcb4d645b1d31c6b8199b95c4000ea6e7d40580
SSDEEP

98304:iSLCUGG+t+aCnfFXL/LNIRDB3YP1SnPWMO5RadDNkZCXA/G3Ra3Eql:8UGGw+zRIRFIP1Y+MooOHwRa3v

Score

10^/10

njrat defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4912	netsh.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation	New Project 1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation	Lammer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe

Executes dropped EXE 4 IoCs

pid	Process
540	SilentPatcher.exe
5044	Lua Injector.exe
1408	Lammer.exe
4524	System.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1436	sc.exe
4192	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Project 1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lua Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lammer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	New Project 1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe
5044	Lua Injector.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe
Token: 33	4524	System.exe
Token: SeIncBasePriorityPrivilege	4524	System.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 540	1928	New Project 1.exe	82
PID 1928 wrote to memory of 540	1928	New Project 1.exe	82
PID 1928 wrote to memory of 5044	1928	New Project 1.exe	84
PID 1928 wrote to memory of 5044	1928	New Project 1.exe	84
PID 1928 wrote to memory of 5044	1928	New Project 1.exe	84
PID 540 wrote to memory of 860	540	SilentPatcher.exe	86
PID 540 wrote to memory of 860	540	SilentPatcher.exe	86
PID 1928 wrote to memory of 1408	1928	New Project 1.exe	87
PID 1928 wrote to memory of 1408	1928	New Project 1.exe	87
PID 1928 wrote to memory of 1408	1928	New Project 1.exe	87
PID 5044 wrote to memory of 4420	5044	Lua Injector.exe	88
PID 5044 wrote to memory of 4420	5044	Lua Injector.exe	88
PID 5044 wrote to memory of 4420	5044	Lua Injector.exe	88
PID 4420 wrote to memory of 1436	4420	cmd.exe	89
PID 4420 wrote to memory of 1436	4420	cmd.exe	89
PID 4420 wrote to memory of 1436	4420	cmd.exe	89
PID 5044 wrote to memory of 2812	5044	Lua Injector.exe	90
PID 5044 wrote to memory of 2812	5044	Lua Injector.exe	90
PID 5044 wrote to memory of 2812	5044	Lua Injector.exe	90
PID 2812 wrote to memory of 4192	2812	cmd.exe	91
PID 2812 wrote to memory of 4192	2812	cmd.exe	91
PID 2812 wrote to memory of 4192	2812	cmd.exe	91
PID 1408 wrote to memory of 4524	1408	Lammer.exe	97
PID 1408 wrote to memory of 4524	1408	Lammer.exe	97
PID 1408 wrote to memory of 4524	1408	Lammer.exe	97
PID 4524 wrote to memory of 4912	4524	System.exe	100
PID 4524 wrote to memory of 4912	4524	System.exe	100
PID 4524 wrote to memory of 4912	4524	System.exe	100

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
860	attrib.exe

C:\Users\Admin\AppData\Local\Temp\New Project 1.exe
"C:\Users\Admin\AppData\Local\Temp\New Project 1.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
    3⤵
    - Views/modifies file attributes
    PID:860
- C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start FairplayKD > NUL 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\SysWOW64\sc.exe
      sc start FairplayKD
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop %c > NUL 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\SysWOW64\sc.exe
      sc stop %c
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4192
- C:\Users\Admin\AppData\Local\Temp\Lammer.exe
  "C:\Users\Admin\AppData\Local\Temp\Lammer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\ProgramData\System.exe
    "C:\ProgramData\System.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\ProgramData\System.exe" "System.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Lammer.exe

Filesize
23KB

MD5
8ef1c362e7a42893a331a657d021d665

SHA1
fdfe06f05c2a51ef8968ddc1d9a7595d694c93f8

SHA256
db27bc172a5de048b3514746a8d78bfda52828ac10bf929fc89839b2cdc9deab

SHA512
978e8ea7504b32f1d4f18a34f7822c60593ea5bda821cd63d77b7e2e9b13f4fabfc5f89ec681cbcf88669138b2936394761e4da58e223d80c3948e28148ce299

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe

Filesize
2.1MB

MD5
6b1ae040f09a43a4f0eee6fd964e2a47

SHA1
5d5ae0e6d89612fa55286f12f3a09443408ac1df

SHA256
d1163ec121ee6bdd11496c227b5f09a69cd2172aca93d111fac1be0cf73be0f2

SHA512
e6a7ad8d8245b7fa009b77c77e5d85059bcc6802247b72a5bf927a97390650d446f83984c43a3fd6cd5f5a35f747bda6b5d1e408aa59f212a856cc9eaca861a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe

Filesize
2.6MB

MD5
7145358dc4b4908c33481df669f6a0f4

SHA1
87f13e788bd0bc105f1a9e992166ac819488d9c5

SHA256
d1035e2bc6fe5b8450d60f6c45c4d9479a014cec0f15cfd00a23a65a5e10634a

SHA512
164c6506b0df97877e15f1b2a668f06521b510817575d9c6df716bdf51e6deac20e2c78eb4ca1f42f4337aec7b747f7ebbcc5d7821a3ce92ac68aca8bd0c184a

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
memory/1408-108-0x0000000075252000-0x0000000075253000-memory.dmp

Filesize
4KB

Download
memory/1408-109-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download
memory/1408-122-0x0000000075250000-0x0000000075801000-memory.dmp

Filesize
5.7MB

Download
memory/1928-0-0x0000000000400000-0x0000000000B04000-memory.dmp

Filesize
7.0MB

Download