njrat | cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d

Analysis

max time kernel
82s
max time network
84s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-01-2025 17:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Gaming Chair.exe
Size

7.0MB
MD5

b97c8aab67e949a5e43905ceed9b0319
SHA1

5b9f0aa33a1e4e325370711d950fdf06b737993f
SHA256

cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d
SHA512

e2c3a1773859c6e76a1dc155593ff96983cd1d499c4e9e3ff732027167d81b484c0d774652a7486e778b66b7abcb4d645b1d31c6b8199b95c4000ea6e7d40580
SSDEEP

98304:iSLCUGG+t+aCnfFXL/LNIRDB3YP1SnPWMO5RadDNkZCXA/G3Ra3Eql:8UGGw+zRIRFIP1Y+MooOHwRa3v

Score

10^/10

njrat defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
564	netsh.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe

Executes dropped EXE 4 IoCs

pid	Process
4688	SilentPatcher.exe
3968	Lua Injector.exe
1708	Lammer.exe
1776	System.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4600	sc.exe
1404	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lammer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaming Chair.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lua Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "183"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Gaming Chair.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe
3968	Lua Injector.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	System.exe
Token: 33	1776	System.exe
Token: SeIncBasePriorityPrivilege	1776	System.exe
Token: 33	1776	System.exe
Token: SeIncBasePriorityPrivilege	1776	System.exe
Token: 33	1776	System.exe
Token: SeIncBasePriorityPrivilege	1776	System.exe
Token: 33	1776	System.exe
Token: SeIncBasePriorityPrivilege	1776	System.exe
Token: 33	1776	System.exe
Token: SeIncBasePriorityPrivilege	1776	System.exe
Token: 33	1776	System.exe
Token: SeIncBasePriorityPrivilege	1776	System.exe
Token: 33	1776	System.exe
Token: SeIncBasePriorityPrivilege	1776	System.exe
Token: 33	1776	System.exe
Token: SeIncBasePriorityPrivilege	1776	System.exe
Token: SeShutdownPrivilege	3628	shutdown.exe
Token: SeRemoteShutdownPrivilege	3628	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1904	PickerHost.exe
1428	LogonUI.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4688	2376	Gaming Chair.exe	77
PID 2376 wrote to memory of 4688	2376	Gaming Chair.exe	77
PID 2376 wrote to memory of 3968	2376	Gaming Chair.exe	79
PID 2376 wrote to memory of 3968	2376	Gaming Chair.exe	79
PID 2376 wrote to memory of 3968	2376	Gaming Chair.exe	79
PID 4688 wrote to memory of 1396	4688	SilentPatcher.exe	81
PID 4688 wrote to memory of 1396	4688	SilentPatcher.exe	81
PID 2376 wrote to memory of 1708	2376	Gaming Chair.exe	82
PID 2376 wrote to memory of 1708	2376	Gaming Chair.exe	82
PID 2376 wrote to memory of 1708	2376	Gaming Chair.exe	82
PID 3968 wrote to memory of 3252	3968	Lua Injector.exe	83
PID 3968 wrote to memory of 3252	3968	Lua Injector.exe	83
PID 3968 wrote to memory of 3252	3968	Lua Injector.exe	83
PID 3252 wrote to memory of 4600	3252	cmd.exe	84
PID 3252 wrote to memory of 4600	3252	cmd.exe	84
PID 3252 wrote to memory of 4600	3252	cmd.exe	84
PID 3968 wrote to memory of 400	3968	Lua Injector.exe	85
PID 3968 wrote to memory of 400	3968	Lua Injector.exe	85
PID 3968 wrote to memory of 400	3968	Lua Injector.exe	85
PID 400 wrote to memory of 1404	400	cmd.exe	86
PID 400 wrote to memory of 1404	400	cmd.exe	86
PID 400 wrote to memory of 1404	400	cmd.exe	86
PID 1708 wrote to memory of 1776	1708	Lammer.exe	87
PID 1708 wrote to memory of 1776	1708	Lammer.exe	87
PID 1708 wrote to memory of 1776	1708	Lammer.exe	87
PID 1776 wrote to memory of 564	1776	System.exe	88
PID 1776 wrote to memory of 564	1776	System.exe	88
PID 1776 wrote to memory of 564	1776	System.exe	88
PID 1776 wrote to memory of 3140	1776	System.exe	91
PID 1776 wrote to memory of 3140	1776	System.exe	91
PID 1776 wrote to memory of 3140	1776	System.exe	91
PID 3140 wrote to memory of 3628	3140	cmd.exe	93
PID 3140 wrote to memory of 3628	3140	cmd.exe	93
PID 3140 wrote to memory of 3628	3140	cmd.exe	93

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1396	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Gaming Chair.exe
"C:\Users\Admin\AppData\Local\Temp\Gaming Chair.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
    3⤵
    - Views/modifies file attributes
    PID:1396
- C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start FairplayKD > NUL 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\SysWOW64\sc.exe
      sc start FairplayKD
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop %c > NUL 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Windows\SysWOW64\sc.exe
      sc stop %c
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1404
- C:\Users\Admin\AppData\Local\Temp\Lammer.exe
  "C:\Users\Admin\AppData\Local\Temp\Lammer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\ProgramData\System.exe
    "C:\ProgramData\System.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\ProgramData\System.exe" "System.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp90B2.tmp.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3140
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -r -t 1
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3628

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1904

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d1055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Lammer.exe

Filesize
23KB

MD5
8ef1c362e7a42893a331a657d021d665

SHA1
fdfe06f05c2a51ef8968ddc1d9a7595d694c93f8

SHA256
db27bc172a5de048b3514746a8d78bfda52828ac10bf929fc89839b2cdc9deab

SHA512
978e8ea7504b32f1d4f18a34f7822c60593ea5bda821cd63d77b7e2e9b13f4fabfc5f89ec681cbcf88669138b2936394761e4da58e223d80c3948e28148ce299

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe

Filesize
2.1MB

MD5
6b1ae040f09a43a4f0eee6fd964e2a47

SHA1
5d5ae0e6d89612fa55286f12f3a09443408ac1df

SHA256
d1163ec121ee6bdd11496c227b5f09a69cd2172aca93d111fac1be0cf73be0f2

SHA512
e6a7ad8d8245b7fa009b77c77e5d85059bcc6802247b72a5bf927a97390650d446f83984c43a3fd6cd5f5a35f747bda6b5d1e408aa59f212a856cc9eaca861a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe

Filesize
2.6MB

MD5
7145358dc4b4908c33481df669f6a0f4

SHA1
87f13e788bd0bc105f1a9e992166ac819488d9c5

SHA256
d1035e2bc6fe5b8450d60f6c45c4d9479a014cec0f15cfd00a23a65a5e10634a

SHA512
164c6506b0df97877e15f1b2a668f06521b510817575d9c6df716bdf51e6deac20e2c78eb4ca1f42f4337aec7b747f7ebbcc5d7821a3ce92ac68aca8bd0c184a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp90B2.tmp.bat

Filesize
34B

MD5
886b428020420fbe31c8c069cf14805c

SHA1
dd51443a6b8cdf52cd7c0ba6658095aa92af50f8

SHA256
8c8e929fc84a367af1a7f1bebf6be1a544ce334f0677ac6db9863abed73fe778

SHA512
0789ea923daeb3ac518a05ccc905987e991eaf081f1c7a67a0dcbea71e328d331101129566edacb1910323c8180fd481d9bf9602ab0e2fcb3bdc41a0880c3b2f

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
memory/1708-99-0x0000000074021000-0x0000000074022000-memory.dmp

Filesize
4KB

Download
memory/1708-100-0x0000000074020000-0x00000000745D1000-memory.dmp

Filesize
5.7MB

Download
memory/1708-110-0x0000000074020000-0x00000000745D1000-memory.dmp

Filesize
5.7MB

Download
memory/2376-0-0x0000000000400000-0x0000000000B04000-memory.dmp

Filesize
7.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads