njrat | cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d

General

Target

Lua Injector.exe
Size

7.0MB
MD5

b97c8aab67e949a5e43905ceed9b0319
SHA1

5b9f0aa33a1e4e325370711d950fdf06b737993f
SHA256

cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d
SHA512

e2c3a1773859c6e76a1dc155593ff96983cd1d499c4e9e3ff732027167d81b484c0d774652a7486e778b66b7abcb4d645b1d31c6b8199b95c4000ea6e7d40580
SSDEEP

98304:iSLCUGG+t+aCnfFXL/LNIRDB3YP1SnPWMO5RadDNkZCXA/G3Ra3Eql:8UGGw+zRIRFIP1Y+MooOHwRa3v

Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3652	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000\Control Panel\International\Geo\Nation	Lua Injector.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000\Control Panel\International\Geo\Nation	Lammer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe

Executes dropped EXE 3 IoCs

pid	Process
1876	SilentPatcher.exe
1092	Lammer.exe
548	System.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lua Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lammer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Lua Injector.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe
Token: 33	548	System.exe
Token: SeIncBasePriorityPrivilege	548	System.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 1876	2752	Lua Injector.exe	83
PID 2752 wrote to memory of 1876	2752	Lua Injector.exe	83
PID 2752 wrote to memory of 1092	2752	Lua Injector.exe	85
PID 2752 wrote to memory of 1092	2752	Lua Injector.exe	85
PID 2752 wrote to memory of 1092	2752	Lua Injector.exe	85
PID 1876 wrote to memory of 4072	1876	SilentPatcher.exe	86
PID 1876 wrote to memory of 4072	1876	SilentPatcher.exe	86
PID 1092 wrote to memory of 548	1092	Lammer.exe	92
PID 1092 wrote to memory of 548	1092	Lammer.exe	92
PID 1092 wrote to memory of 548	1092	Lammer.exe	92
PID 548 wrote to memory of 3652	548	System.exe	95
PID 548 wrote to memory of 3652	548	System.exe	95
PID 548 wrote to memory of 3652	548	System.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4072	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
    3⤵
    - Views/modifies file attributes
    PID:4072
- C:\Users\Admin\AppData\Local\Temp\Lammer.exe
  "C:\Users\Admin\AppData\Local\Temp\Lammer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\ProgramData\System.exe
    "C:\ProgramData\System.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:548
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\ProgramData\System.exe" "System.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Lammer.exe

Filesize
23KB

MD5
8ef1c362e7a42893a331a657d021d665

SHA1
fdfe06f05c2a51ef8968ddc1d9a7595d694c93f8

SHA256
db27bc172a5de048b3514746a8d78bfda52828ac10bf929fc89839b2cdc9deab

SHA512
978e8ea7504b32f1d4f18a34f7822c60593ea5bda821cd63d77b7e2e9b13f4fabfc5f89ec681cbcf88669138b2936394761e4da58e223d80c3948e28148ce299

Download Submit
C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe

Filesize
2.6MB

MD5
7145358dc4b4908c33481df669f6a0f4

SHA1
87f13e788bd0bc105f1a9e992166ac819488d9c5

SHA256
d1035e2bc6fe5b8450d60f6c45c4d9479a014cec0f15cfd00a23a65a5e10634a

SHA512
164c6506b0df97877e15f1b2a668f06521b510817575d9c6df716bdf51e6deac20e2c78eb4ca1f42f4337aec7b747f7ebbcc5d7821a3ce92ac68aca8bd0c184a

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
memory/1092-73-0x0000000074902000-0x0000000074903000-memory.dmp

Filesize
4KB

Download
memory/1092-74-0x0000000074900000-0x0000000074EB1000-memory.dmp

Filesize
5.7MB

Download
memory/1092-75-0x0000000074900000-0x0000000074EB1000-memory.dmp

Filesize
5.7MB

Download
memory/1092-88-0x0000000074900000-0x0000000074EB1000-memory.dmp

Filesize
5.7MB

Download
memory/2752-0-0x0000000000400000-0x0000000000B04000-memory.dmp

Filesize
7.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads