njrat | c3eecda765f66631358e23cbb02741b4e2fb2e56c76520d5a83b249ee8f929d8

General

Target

Payload.exe
Size

55KB
MD5

2fb0487c62fddc8148bb9c1e7a61ff0b
SHA1

166f462038f8db0cc6462c8f6de5f3098968b7da
SHA256

c3eecda765f66631358e23cbb02741b4e2fb2e56c76520d5a83b249ee8f929d8
SHA512

0fb567a204b6ed8c0104ac893168800fd4f40c3c6bebba1d446c53f5107a6b6bfea5d1d47c77f32efae765c675c976dbd64f541c671f7348100efc4659f42cc9
SSDEEP

1536:kdmIDn/NOryWhI0DGwsNMDmXExI3pmSm:BIDnE+v0DGwsNMDmXExI3pm

Score

10^/10

njrat discovery trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
4348	dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4348	dllhost.exe
4348	dllhost.exe
4348	dllhost.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe
Token: 33	4348	dllhost.exe
Token: SeIncBasePriorityPrivilege	4348	dllhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5536	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4348	3124	Payload.exe	84
PID 3124 wrote to memory of 4348	3124	Payload.exe	84
PID 3124 wrote to memory of 4348	3124	Payload.exe	84

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Users\Admin\dllhost.exe
  "C:\Users\Admin\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4348

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
e4502e12eddb65147ccb0c39021d5c54

SHA1
e0c340c26168e569ed1b09955e386922b9c76fc0

SHA256
ca1d08100dade9a95b1f93a37ac07587d9dca6866a8cb87436aadd5d29c86d6c

SHA512
9619f8745eaa0f18f6372258d3e7e068c0347fb1effa578bff7d173d6ee49507610316036c712834f8e336a01e95ba8d6ba8270ae1a439481877cc37b51405fd

Download Submit
C:\Users\Admin\dllhost.exe

Filesize
55KB

MD5
2fb0487c62fddc8148bb9c1e7a61ff0b

SHA1
166f462038f8db0cc6462c8f6de5f3098968b7da

SHA256
c3eecda765f66631358e23cbb02741b4e2fb2e56c76520d5a83b249ee8f929d8

SHA512
0fb567a204b6ed8c0104ac893168800fd4f40c3c6bebba1d446c53f5107a6b6bfea5d1d47c77f32efae765c675c976dbd64f541c671f7348100efc4659f42cc9

Download Submit
memory/3124-0-0x0000000074691000-0x0000000074692000-memory.dmp

Filesize
4KB

Download
memory/3124-1-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/3124-2-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/3124-21-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/4348-22-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/4348-23-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/4348-24-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/4348-25-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/4348-26-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/4348-27-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing