Overview

overview

10

Static

static

10

b12ace4779...bf.exe

windows7-x64

10

b12ace4779...bf.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf.exe

  • Size

    93KB

  • Sample

    250128-hmdr8s1jds

  • MD5

    a9ba2416df448c5f3b36581ecfa4cd31

  • SHA1

    105592c84c83cbf4e6f7b6978ecb6d37c99440b7

  • SHA256

    b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf

  • SHA512

    456ffb46cf5d914108a68292e1f9e73665e7dd3905015c76709ecc954d02b50d9dfdd758c2178791d75aa1010b7c0f2e0cf92659f2471a227497343477e6c9f3

  • SSDEEP

    768:+Y3DCdhWXxyFcxovUKUJuROprXtgN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3GsGdpQgM:hCzWhIUKcuOJXPhBjEwzGi1dDiDQgS

Score
10/10
njrathackeddefense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:5513
Mutex

67364a37f43593883a7b70eb2426799a

Attributes
  • reg_key

    67364a37f43593883a7b70eb2426799a

  • splitter

    |'|'|

Targets

    • Target

      b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf.exe

    • Size

      93KB

    • MD5

      a9ba2416df448c5f3b36581ecfa4cd31

    • SHA1

      105592c84c83cbf4e6f7b6978ecb6d37c99440b7

    • SHA256

      b12ace477963fdde7e7b3c3b81dc01d585d87097e68bed90f5dd41077556b4bf

    • SHA512

      456ffb46cf5d914108a68292e1f9e73665e7dd3905015c76709ecc954d02b50d9dfdd758c2178791d75aa1010b7c0f2e0cf92659f2471a227497343477e6c9f3

    • SSDEEP

      768:+Y3DCdhWXxyFcxovUKUJuROprXtgN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3GsGdpQgM:hCzWhIUKcuOJXPhBjEwzGi1dDiDQgS

    Score
    10/10
    njrathackeddefense_evasiondiscoverypersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Disables Task Manager via registry modification

      defense_evasion

    • Modifies Windows Firewall

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks