Overview

overview

10

Static

static

3

Gaming Chair.exe

windows10-2004-x64

Gaming Chair.exe

windows10-ltsc 2021-x64

Gaming Chair.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Gaming Chair.exe

  • Size

    7.0MB

  • Sample

    250122-vxg9maxpbl

  • MD5

    b97c8aab67e949a5e43905ceed9b0319

  • SHA1

    5b9f0aa33a1e4e325370711d950fdf06b737993f

  • SHA256

    cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d

  • SHA512

    e2c3a1773859c6e76a1dc155593ff96983cd1d499c4e9e3ff732027167d81b484c0d774652a7486e778b66b7abcb4d645b1d31c6b8199b95c4000ea6e7d40580

  • SSDEEP

    98304:iSLCUGG+t+aCnfFXL/LNIRDB3YP1SnPWMO5RadDNkZCXA/G3Ra3Eql:8UGGw+zRIRFIP1Y+MooOHwRa3v

Score
10/10
njratlammerdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

C2

station-gps.gl.at.ply.gg:26933

Mutex

ded5a8703334377d83da00a864706211

Attributes
  • reg_key

    ded5a8703334377d83da00a864706211

  • splitter

    |'|'|

Targets

    • Target

      Gaming Chair.exe

    • Size

      7.0MB

    • MD5

      b97c8aab67e949a5e43905ceed9b0319

    • SHA1

      5b9f0aa33a1e4e325370711d950fdf06b737993f

    • SHA256

      cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d

    • SHA512

      e2c3a1773859c6e76a1dc155593ff96983cd1d499c4e9e3ff732027167d81b484c0d774652a7486e778b66b7abcb4d645b1d31c6b8199b95c4000ea6e7d40580

    • SSDEEP

      98304:iSLCUGG+t+aCnfFXL/LNIRDB3YP1SnPWMO5RadDNkZCXA/G3Ra3Eql:8UGGw+zRIRFIP1Y+MooOHwRa3v

    Score
    10/10
    njratdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojanlammer

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      defense_evasion

    • Stops running service(s)

      defense_evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks