njrat | cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d

Analysis

max time kernel
87s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 17:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Gaming Chair.exe
Size

7.0MB
MD5

b97c8aab67e949a5e43905ceed9b0319
SHA1

5b9f0aa33a1e4e325370711d950fdf06b737993f
SHA256

cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d
SHA512

e2c3a1773859c6e76a1dc155593ff96983cd1d499c4e9e3ff732027167d81b484c0d774652a7486e778b66b7abcb4d645b1d31c6b8199b95c4000ea6e7d40580
SSDEEP

98304:iSLCUGG+t+aCnfFXL/LNIRDB3YP1SnPWMO5RadDNkZCXA/G3Ra3Eql:8UGGw+zRIRFIP1Y+MooOHwRa3v

Score

10^/10

njrat defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4928	netsh.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Gaming Chair.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Lammer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe

Executes dropped EXE 4 IoCs

pid	Process
3552	SilentPatcher.exe
4076	Lua Injector.exe
2988	Lammer.exe
3892	System.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2052	sc.exe
1568	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaming Chair.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lammer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lua Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "206"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Gaming Chair.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe
4076	Lua Injector.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	System.exe
Token: 33	3892	System.exe
Token: SeIncBasePriorityPrivilege	3892	System.exe
Token: 33	3892	System.exe
Token: SeIncBasePriorityPrivilege	3892	System.exe
Token: 33	3892	System.exe
Token: SeIncBasePriorityPrivilege	3892	System.exe
Token: 33	3892	System.exe
Token: SeIncBasePriorityPrivilege	3892	System.exe
Token: 33	3892	System.exe
Token: SeIncBasePriorityPrivilege	3892	System.exe
Token: 33	3892	System.exe
Token: SeIncBasePriorityPrivilege	3892	System.exe
Token: 33	3892	System.exe
Token: SeIncBasePriorityPrivilege	3892	System.exe
Token: 33	3892	System.exe
Token: SeIncBasePriorityPrivilege	3892	System.exe
Token: SeShutdownPrivilege	4988	shutdown.exe
Token: SeRemoteShutdownPrivilege	4988	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3212	LogonUI.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 3552	3164	Gaming Chair.exe	83
PID 3164 wrote to memory of 3552	3164	Gaming Chair.exe	83
PID 3164 wrote to memory of 4076	3164	Gaming Chair.exe	85
PID 3164 wrote to memory of 4076	3164	Gaming Chair.exe	85
PID 3164 wrote to memory of 4076	3164	Gaming Chair.exe	85
PID 3552 wrote to memory of 3512	3552	SilentPatcher.exe	87
PID 3552 wrote to memory of 3512	3552	SilentPatcher.exe	87
PID 3164 wrote to memory of 2988	3164	Gaming Chair.exe	88
PID 3164 wrote to memory of 2988	3164	Gaming Chair.exe	88
PID 3164 wrote to memory of 2988	3164	Gaming Chair.exe	88
PID 4076 wrote to memory of 2644	4076	Lua Injector.exe	89
PID 4076 wrote to memory of 2644	4076	Lua Injector.exe	89
PID 4076 wrote to memory of 2644	4076	Lua Injector.exe	89
PID 2644 wrote to memory of 2052	2644	cmd.exe	90
PID 2644 wrote to memory of 2052	2644	cmd.exe	90
PID 2644 wrote to memory of 2052	2644	cmd.exe	90
PID 4076 wrote to memory of 3844	4076	Lua Injector.exe	91
PID 4076 wrote to memory of 3844	4076	Lua Injector.exe	91
PID 4076 wrote to memory of 3844	4076	Lua Injector.exe	91
PID 3844 wrote to memory of 1568	3844	cmd.exe	92
PID 3844 wrote to memory of 1568	3844	cmd.exe	92
PID 3844 wrote to memory of 1568	3844	cmd.exe	92
PID 2988 wrote to memory of 3892	2988	Lammer.exe	100
PID 2988 wrote to memory of 3892	2988	Lammer.exe	100
PID 2988 wrote to memory of 3892	2988	Lammer.exe	100
PID 3892 wrote to memory of 4928	3892	System.exe	108
PID 3892 wrote to memory of 4928	3892	System.exe	108
PID 3892 wrote to memory of 4928	3892	System.exe	108
PID 3892 wrote to memory of 2736	3892	System.exe	115
PID 3892 wrote to memory of 2736	3892	System.exe	115
PID 3892 wrote to memory of 2736	3892	System.exe	115
PID 2736 wrote to memory of 4988	2736	cmd.exe	117
PID 2736 wrote to memory of 4988	2736	cmd.exe	117
PID 2736 wrote to memory of 4988	2736	cmd.exe	117

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3512	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Gaming Chair.exe
"C:\Users\Admin\AppData\Local\Temp\Gaming Chair.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
    3⤵
    - Views/modifies file attributes
    PID:3512
- C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start FairplayKD > NUL 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\sc.exe
      sc start FairplayKD
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop %c > NUL 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\SysWOW64\sc.exe
      sc stop %c
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1568
- C:\Users\Admin\AppData\Local\Temp\Lammer.exe
  "C:\Users\Admin\AppData\Local\Temp\Lammer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\ProgramData\System.exe
    "C:\ProgramData\System.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\ProgramData\System.exe" "System.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB968.tmp.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -r -t 1
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38cd855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Lammer.exe

Filesize
23KB

MD5
8ef1c362e7a42893a331a657d021d665

SHA1
fdfe06f05c2a51ef8968ddc1d9a7595d694c93f8

SHA256
db27bc172a5de048b3514746a8d78bfda52828ac10bf929fc89839b2cdc9deab

SHA512
978e8ea7504b32f1d4f18a34f7822c60593ea5bda821cd63d77b7e2e9b13f4fabfc5f89ec681cbcf88669138b2936394761e4da58e223d80c3948e28148ce299

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe

Filesize
2.1MB

MD5
6b1ae040f09a43a4f0eee6fd964e2a47

SHA1
5d5ae0e6d89612fa55286f12f3a09443408ac1df

SHA256
d1163ec121ee6bdd11496c227b5f09a69cd2172aca93d111fac1be0cf73be0f2

SHA512
e6a7ad8d8245b7fa009b77c77e5d85059bcc6802247b72a5bf927a97390650d446f83984c43a3fd6cd5f5a35f747bda6b5d1e408aa59f212a856cc9eaca861a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe

Filesize
2.6MB

MD5
7145358dc4b4908c33481df669f6a0f4

SHA1
87f13e788bd0bc105f1a9e992166ac819488d9c5

SHA256
d1035e2bc6fe5b8450d60f6c45c4d9479a014cec0f15cfd00a23a65a5e10634a

SHA512
164c6506b0df97877e15f1b2a668f06521b510817575d9c6df716bdf51e6deac20e2c78eb4ca1f42f4337aec7b747f7ebbcc5d7821a3ce92ac68aca8bd0c184a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB968.tmp.bat

Filesize
34B

MD5
886b428020420fbe31c8c069cf14805c

SHA1
dd51443a6b8cdf52cd7c0ba6658095aa92af50f8

SHA256
8c8e929fc84a367af1a7f1bebf6be1a544ce334f0677ac6db9863abed73fe778

SHA512
0789ea923daeb3ac518a05ccc905987e991eaf081f1c7a67a0dcbea71e328d331101129566edacb1910323c8180fd481d9bf9602ab0e2fcb3bdc41a0880c3b2f

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
memory/2988-99-0x0000000072802000-0x0000000072803000-memory.dmp

Filesize
4KB

Download
memory/2988-100-0x0000000072800000-0x0000000072DB1000-memory.dmp

Filesize
5.7MB

Download
memory/2988-101-0x0000000072800000-0x0000000072DB1000-memory.dmp

Filesize
5.7MB

Download
memory/2988-111-0x0000000072800000-0x0000000072DB1000-memory.dmp

Filesize
5.7MB

Download
memory/3164-0-0x0000000000400000-0x0000000000B04000-memory.dmp

Filesize
7.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads