njrat | 49799902857cfb628defc1c4af547d271b368814642204fbfee93e642c4b50bc

General

Target

New Project 1.exe
Size

5.3MB
MD5

b6f0198be0dd6b37cae764d9a969366e
SHA1

aa8d5622aea5a0024f54d70f873fb3e8d32bfa13
SHA256

49799902857cfb628defc1c4af547d271b368814642204fbfee93e642c4b50bc
SHA512

92da3f546e5435cda93fd910c9e294849b67ebfa941d7522efc50f38aa04c9510378f66387eee404c11ff60d1b5cab51bd16cb5186476965ca5fd891035cc513
SSDEEP

98304:aj2Q5odAGY95wpWB8GHfHSw5h8mO05cVlOqV1Kmw9m:Q1ipWqG/N5TRqfKmw9

Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
428	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9f11944eabc84127389f5afd8d95ec8.exe	Registry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9f11944eabc84127389f5afd8d95ec8.exe	Registry.exe

Executes dropped EXE 5 IoCs

pid	Process
3828	SilentPatcher.exe
248	GH Injector - x64.exe
3832	GH Injector SWHEX - x64.exe
4764	Lammer.exe
3568	Registry.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\a9f11944eabc84127389f5afd8d95ec8 = "\"C:\\ProgramData\\Registry.exe\" .."	Registry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a9f11944eabc84127389f5afd8d95ec8 = "\"C:\\ProgramData\\Registry.exe\" .."	Registry.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/248-117-0x00007FF65C100000-0x00007FF65C308000-memory.dmp	autoit_exe
behavioral1/memory/248-168-0x00007FF65C100000-0x00007FF65C308000-memory.dmp	autoit_exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001c00000002aa84-37.dat	upx
behavioral1/memory/248-117-0x00007FF65C100000-0x00007FF65C308000-memory.dmp	upx
behavioral1/memory/248-168-0x00007FF65C100000-0x00007FF65C308000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Project 1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lammer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Registry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	New Project 1.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3568	Registry.exe
Token: 33	3568	Registry.exe
Token: SeIncBasePriorityPrivilege	3568	Registry.exe
Token: 33	3568	Registry.exe
Token: SeIncBasePriorityPrivilege	3568	Registry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1280	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 3828	4744	New Project 1.exe	77
PID 4744 wrote to memory of 3828	4744	New Project 1.exe	77
PID 4744 wrote to memory of 248	4744	New Project 1.exe	79
PID 4744 wrote to memory of 248	4744	New Project 1.exe	79
PID 4744 wrote to memory of 3832	4744	New Project 1.exe	80
PID 4744 wrote to memory of 3832	4744	New Project 1.exe	80
PID 4744 wrote to memory of 4764	4744	New Project 1.exe	82
PID 4744 wrote to memory of 4764	4744	New Project 1.exe	82
PID 4744 wrote to memory of 4764	4744	New Project 1.exe	82
PID 3828 wrote to memory of 4536	3828	SilentPatcher.exe	83
PID 3828 wrote to memory of 4536	3828	SilentPatcher.exe	83
PID 4764 wrote to memory of 3568	4764	Lammer.exe	84
PID 4764 wrote to memory of 3568	4764	Lammer.exe	84
PID 4764 wrote to memory of 3568	4764	Lammer.exe	84
PID 3568 wrote to memory of 428	3568	Registry.exe	87
PID 3568 wrote to memory of 428	3568	Registry.exe	87
PID 3568 wrote to memory of 428	3568	Registry.exe	87

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4536	attrib.exe

C:\Users\Admin\AppData\Local\Temp\New Project 1.exe
"C:\Users\Admin\AppData\Local\Temp\New Project 1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
    3⤵
    - Views/modifies file attributes
    PID:4536
- C:\Users\Admin\AppData\Local\Temp\GH Injector - x64.exe
  "C:\Users\Admin\AppData\Local\Temp\GH Injector - x64.exe"
  2⤵
  - Executes dropped EXE
  PID:248
- C:\Users\Admin\AppData\Local\Temp\GH Injector SWHEX - x64.exe
  "C:\Users\Admin\AppData\Local\Temp\GH Injector SWHEX - x64.exe"
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Users\Admin\AppData\Local\Temp\Lammer.exe
  "C:\Users\Admin\AppData\Local\Temp\Lammer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\ProgramData\Registry.exe
    "C:\ProgramData\Registry.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\ProgramData\Registry.exe" "Registry.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:428

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
069c37bf9e39b121efb7a28ece933aee

SHA1
eaef2e55b66e543a14a6780c23bb83fe60f2f04d

SHA256
485db8db6b497d31d428aceea416da20d88f7bde88dbfd6d59e3e7eee0a75ae8

SHA512
f4562071143c2ebc259a20cbb45b133c863f127a5750672b7a2af47783c7cdc56dcf1064ae83f54e5fc0bb4e93826bf2ab4ef6e604f955bf594f2cbd641db796

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
eed640164203d0d0a2a1e7919a6fdbdf

SHA1
9af74121e090cf2970beee82d22ef4ebb886c0ae

SHA256
4ca7fe712b4322fdb497733e015f4ae4496d3998772a6c37305da3cbba3eb7ae

SHA512
1bf6de193ae00189525ea9a685bbe3dc7722eceb6ccfb83c70adc766b6301b4978abf73b2f8f41b865f1521925308e4f96285dca569e9c2b2c61e79db1100e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GH Injector - x64.exe

Filesize
927KB

MD5
fac188061068468b413905c05ffe4a2e

SHA1
bc5159c4a2aabc8b138fd28da099c5c6e4e87c86

SHA256
16ac233c0be5784cf4b3bb0b3c94a9732609c6725d3982736280f04195d5304a

SHA512
3750a9e46d0d43e95e2369996661bc0c82511242c79d2aacd4e09455bba3abb8fa6eaf51880875d75cb920543108a5c8c8ebf6c0ea4fcf05a99eb40a6dd2357b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GH Injector SWHEX - x64.exe

Filesize
27KB

MD5
e80faaf635cc8a67ce128a77db91cf5a

SHA1
581f8f3651fba45287e211e55a4dc019428e98d9

SHA256
550e76bcffc9835e18d0558a1295c5517ff636b20ee4620fb8ba29d45b3be3dc

SHA512
e5fc5e9f8664ec5ce3acd789da568c0800a1a2b1861beb05c5d5ce2f329e9141d1dba71e32907500f54c3cbc18ad9ef7bde0ccce716ff9dd27c00318cf4ed506

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lammer.exe

Filesize
23KB

MD5
917427dea7dfc198a90d6d89962f4bec

SHA1
17da3648c0690f5eb17d371978fcc3bc5719a0a5

SHA256
d23b9046db5f50fb93fe127dd94e7928c0f532c260ac60ad208085bbeb5b5b16

SHA512
50e92f734b17f1a422230a0936546e6e083392385edf65172a85ee7f457fe8524f791f01d73de4bde1851e14cdcfbae0ba5defd15e906849b8cc3563a80d3e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe

Filesize
2.6MB

MD5
7145358dc4b4908c33481df669f6a0f4

SHA1
87f13e788bd0bc105f1a9e992166ac819488d9c5

SHA256
d1035e2bc6fe5b8450d60f6c45c4d9479a014cec0f15cfd00a23a65a5e10634a

SHA512
164c6506b0df97877e15f1b2a668f06521b510817575d9c6df716bdf51e6deac20e2c78eb4ca1f42f4337aec7b747f7ebbcc5d7821a3ce92ac68aca8bd0c184a

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
memory/248-117-0x00007FF65C100000-0x00007FF65C308000-memory.dmp

Filesize
2.0MB

Download
memory/248-168-0x00007FF65C100000-0x00007FF65C308000-memory.dmp

Filesize
2.0MB

Download
memory/4744-0-0x0000000000400000-0x0000000000950000-memory.dmp

Filesize
5.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads