njrat | 865e5ebcd7eb823bb5f06c4e27d2a551a08a768dbc8b88e6897a496ccc196c9c

General

Target

Robux Generator.exe
Size

486KB
MD5

6f14554ba359725f14b29b988ecad563
SHA1

1be38cdaf764d9eca1ffb8864afd673e4e85f493
SHA256

ded4912af5e5940c909772abd849e9297fcef31d25b7fa77e28946d5c506e1d7
SHA512

85fcf4da8308bff28d77ada7f3255094cfa77a88bca2241e7a6859774fe06d946f21b3a6b2eeea93c27dd84bbb9b1674c4f5789aa54f84ce9d58fced0c22299d
SSDEEP

6144:Ec0h522p3l04ZMSmIp3Uy28uhyj6w3LTSbKC8RBoCj62iMPWpXQjOHbvryzUDCN4:yhxp3lZnT9bDqw3hCPCj6e2gov2zz0x

Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Downloads MZ/PE file 2 IoCs

flow	pid	Process
34	4408	Process not Found
57	3176	Process not Found

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4760	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation	Robux Generator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation	mvchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6c3f793d259bb6e09e51129bcf1a94f.exe	Microssoft.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6c3f793d259bb6e09e51129bcf1a94f.exe	Microssoft.exe

Executes dropped EXE 3 IoCs

pid	Process
4712	Robux Generator.exe
4148	mvchost.exe
2368	Microssoft.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e6c3f793d259bb6e09e51129bcf1a94f = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microssoft.exe\" .."	Microssoft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e6c3f793d259bb6e09e51129bcf1a94f = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microssoft.exe\" .."	Microssoft.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Robux Generator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mvchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microssoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe
Token: 33	2368	Microssoft.exe
Token: SeIncBasePriorityPrivilege	2368	Microssoft.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4712	2548	Robux Generator.exe	88
PID 2548 wrote to memory of 4712	2548	Robux Generator.exe	88
PID 2548 wrote to memory of 4148	2548	Robux Generator.exe	90
PID 2548 wrote to memory of 4148	2548	Robux Generator.exe	90
PID 2548 wrote to memory of 4148	2548	Robux Generator.exe	90
PID 4148 wrote to memory of 2368	4148	mvchost.exe	92
PID 4148 wrote to memory of 2368	4148	mvchost.exe	92
PID 4148 wrote to memory of 2368	4148	mvchost.exe	92
PID 2368 wrote to memory of 4760	2368	Microssoft.exe	97
PID 2368 wrote to memory of 4760	2368	Microssoft.exe	97
PID 2368 wrote to memory of 4760	2368	Microssoft.exe	97

C:\Users\Admin\AppData\Local\Temp\Robux Generator.exe
"C:\Users\Admin\AppData\Local\Temp\Robux Generator.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Roaming\Robux Generator.exe
  "C:\Users\Admin\AppData\Roaming\Robux Generator.exe"
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Users\Admin\AppData\Roaming\mvchost.exe
  "C:\Users\Admin\AppData\Roaming\mvchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Users\Admin\AppData\Roaming\Microssoft.exe
    "C:\Users\Admin\AppData\Roaming\Microssoft.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microssoft.exe" "Microssoft.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4760

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzNDNzk0NjctMzQxNy00M0RFLTk5OUEtRDJCRkJFMzc5NEM1fSIgdXNlcmlkPSJ7ODcwMzRGM0YtNTQxNi00MjZFLUJFQkEtQ0QzMTlDNzZBMTM4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzhENzgyQkQtOUI1Qi00NTBCLTkzNzgtQkVDMzBDNjkwNjVEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzQ0MDI1MjMzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Robux Generator.exe

Filesize
231KB

MD5
6845a0ce0860208ff707d25fb0e00235

SHA1
e298e2efab66e7dd3575d97955f1cacc874d4be5

SHA256
0e3e8d806b07de3012b1c007aef153ef0f7d8f72ea69ac240193c4adc55ee982

SHA512
52122263beb97f8bc6edf132f3a815045914d7bb633ff466911a6dbdb336aa5b24fa170c19f7157af48367fbb8085c24c6aee068f4880d49dd87508e9f93a92e

Download Submit
C:\Users\Admin\AppData\Roaming\mvchost.exe

Filesize
23KB

MD5
b737985e93a97230ce3773153551d103

SHA1
1e42d57c259467f288a0e68a7b5fae95dcd35e0a

SHA256
8f4f12f4230bc0bb68aad774537028bea0055f463cf99d7c16a5a788f10e705a

SHA512
f1a313919faa656128f2b72035770c91389bfc42e5e3327e2b839327f206508dc43e708d0463097f40e6fe751db5024aed287c5a1fd46152da3e793e6c497d01

Download Submit
memory/4148-26-0x0000000073782000-0x0000000073784000-memory.dmp

Filesize
8KB

Download
memory/4148-33-0x0000000073782000-0x0000000073783000-memory.dmp

Filesize
4KB

Download
memory/4148-22-0x0000000073782000-0x0000000073783000-memory.dmp

Filesize
4KB

Download
memory/4148-24-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/4712-27-0x000000001BB10000-0x000000001BBB6000-memory.dmp

Filesize
664KB

Download
memory/4712-25-0x00007FF9144C5000-0x00007FF9144C6000-memory.dmp

Filesize
4KB

Download
memory/4712-23-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download
memory/4712-28-0x000000001C090000-0x000000001C55E000-memory.dmp

Filesize
4.8MB

Download
memory/4712-29-0x000000001C640000-0x000000001C6DC000-memory.dmp

Filesize
624KB

Download
memory/4712-30-0x0000000001690000-0x0000000001698000-memory.dmp

Filesize
32KB

Download
memory/4712-31-0x000000001C7A0000-0x000000001C7EC000-memory.dmp

Filesize
304KB

Download
memory/4712-32-0x00007FF9144C5000-0x00007FF9144C6000-memory.dmp

Filesize
4KB

Download
memory/4712-21-0x00007FF9144C5000-0x00007FF9144C6000-memory.dmp

Filesize
4KB

Download
memory/4712-43-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads