njrat | 2ca58ea7ab03242dd393bbdd3392b150afd69e349b3199c77cb87185a60e32eb

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
24/02/2025, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40521c1f50c46ac01e69859ed6307205.exe
Size 168KB
Sample250224-1csshsxns5
SHA256 2ca58ea7ab03242dd393bbdd3392b150afd69e349b3199c77cb87185a60e32eb
MD5 40521c1f50c46ac01e69859ed6307205
SHA1 2803993537c87f9523dbda50a08c0fe3b732290d
SHA512 78f30e968a9c950651bd09634e0edf8595181136dc2a83902647d2879d2c41dc14a87600c05a5adb16dff38c331f0733c1754c2f778f4a780fa97e4ca15d1c04
SSDEEP 1536:vGL8lbzmicwmRuX3M5GL8lbzmicwmRuX3M5GL8lbzmicwmRuX3M5GL8lbzmicwmb:O65mRq65mRq65mRq65mR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat discovery persistence trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Dllhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Dllhost.exe

Executes dropped EXE 4 IoCs

pid	Process
2740	Dllhost.exe
2636	Server.exe
1880	Server.exe
1476	Server.exe

Loads dropped DLL 1 IoCs

pid	Process
2520	40521c1f50c46ac01e69859ed6307205.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .."	Dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .."	Dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40521c1f50c46ac01e69859ed6307205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2672	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2520	40521c1f50c46ac01e69859ed6307205.exe
2740	Dllhost.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe
Token: 33	2740	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2740	Dllhost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2740	2520	40521c1f50c46ac01e69859ed6307205.exe	30
PID 2520 wrote to memory of 2740	2520	40521c1f50c46ac01e69859ed6307205.exe	30
PID 2520 wrote to memory of 2740	2520	40521c1f50c46ac01e69859ed6307205.exe	30
PID 2520 wrote to memory of 2740	2520	40521c1f50c46ac01e69859ed6307205.exe	30
PID 2740 wrote to memory of 2672	2740	Dllhost.exe	31
PID 2740 wrote to memory of 2672	2740	Dllhost.exe	31
PID 2740 wrote to memory of 2672	2740	Dllhost.exe	31
PID 2740 wrote to memory of 2672	2740	Dllhost.exe	31
PID 2808 wrote to memory of 2636	2808	taskeng.exe	34
PID 2808 wrote to memory of 2636	2808	taskeng.exe	34
PID 2808 wrote to memory of 2636	2808	taskeng.exe	34
PID 2808 wrote to memory of 2636	2808	taskeng.exe	34
PID 2808 wrote to memory of 1880	2808	taskeng.exe	37
PID 2808 wrote to memory of 1880	2808	taskeng.exe	37
PID 2808 wrote to memory of 1880	2808	taskeng.exe	37
PID 2808 wrote to memory of 1880	2808	taskeng.exe	37
PID 2808 wrote to memory of 1476	2808	taskeng.exe	38
PID 2808 wrote to memory of 1476	2808	taskeng.exe	38
PID 2808 wrote to memory of 1476	2808	taskeng.exe	38
PID 2808 wrote to memory of 1476	2808	taskeng.exe	38

C:\Users\Admin\AppData\Local\Temp\40521c1f50c46ac01e69859ed6307205.exe
"C:\Users\Admin\AppData\Local\Temp\40521c1f50c46ac01e69859ed6307205.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\Dllhost.exe
  "C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2672

C:\Windows\system32\taskeng.exe
taskeng.exe {111248F3-2037-4D05-9ECF-63F702F009DC} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp/Server.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp/Server.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1880
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp/Server.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dllhost.exe

Path \Users\Admin\AppData\Local\Temp\Dllhost.exe
Size 168KB
SHA256 2ca58ea7ab03242dd393bbdd3392b150afd69e349b3199c77cb87185a60e32eb
MD5 40521c1f50c46ac01e69859ed6307205
SHA1 2803993537c87f9523dbda50a08c0fe3b732290d
SHA512 78f30e968a9c950651bd09634e0edf8595181136dc2a83902647d2879d2c41dc14a87600c05a5adb16dff38c331f0733c1754c2f778f4a780fa97e4ca15d1c04
SSDEEP 1536:vGL8lbzmicwmRuX3M5GL8lbzmicwmRuX3M5GL8lbzmicwmRuX3M5GL8lbzmicwmb:O65mRq65mRq65mRq65mR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1476-23-0x00000000000D0000-0x00000000000E0000-memory.dmp

Download

memory/1880-21-0x00000000001E0000-0x00000000001F0000-memory.dmp

Download

memory/2520-0-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Download

memory/2520-1-0x0000000001390000-0x00000000013A0000-memory.dmp

Download

memory/2520-2-0x0000000074C50000-0x000000007533E000-memory.dmp

Download

memory/2520-12-0x0000000074C50000-0x000000007533E000-memory.dmp

Download

memory/2636-19-0x0000000000C40000-0x0000000000C50000-memory.dmp

Download

memory/2740-10-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Download

memory/2740-13-0x0000000074C50000-0x000000007533E000-memory.dmp

Download

memory/2740-11-0x0000000074C50000-0x000000007533E000-memory.dmp

Download

memory/2740-16-0x0000000074C50000-0x000000007533E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads