Overview

overview

10

Static

static

10

bf68ea3c0e...96.exe

windows7-x64

8

bf68ea3c0e...96.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf68ea3c0edd59a4238c9789ba1b4996.exe

  • Size

    37KB

  • Sample

    250201-lmpraaylep

  • MD5

    bf68ea3c0edd59a4238c9789ba1b4996

  • SHA1

    711435121960f811fdf9d98de058bb8e6aa0bf0c

  • SHA256

    32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287

  • SHA512

    13572acd926199b1d63272ea519f3c818ac1e78f43787fe31bc883497b25fafc51fbae54165c703bfdc54dc2263297abfb132bbceb4cefdd133420755c458a29

  • SSDEEP

    384:w+SvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXD:VS7TZ38fvCv3E1c1rM+rMRa8Nuy0t

Score
10/10
njrathackeddefense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

6.tcp.eu.ngrok.io:15553

Mutex

4aa40237a7fcd4c64b196f4bf74d29c3

Attributes
  • reg_key

    4aa40237a7fcd4c64b196f4bf74d29c3

  • splitter

    |'|'|

Targets

    • Target

      bf68ea3c0edd59a4238c9789ba1b4996.exe

    • Size

      37KB

    • MD5

      bf68ea3c0edd59a4238c9789ba1b4996

    • SHA1

      711435121960f811fdf9d98de058bb8e6aa0bf0c

    • SHA256

      32ac6c7faee6ee709f1ac4eac2254c171c683a1911495101caa91012f790a287

    • SHA512

      13572acd926199b1d63272ea519f3c818ac1e78f43787fe31bc883497b25fafc51fbae54165c703bfdc54dc2263297abfb132bbceb4cefdd133420755c458a29

    • SSDEEP

      384:w+SvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXD:VS7TZ38fvCv3E1c1rM+rMRa8Nuy0t

    Score
    8/10
    defense_evasiondiscoverypersistenceprivilege_escalation

    • Modifies Windows Firewall

      defense_evasion

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks