njrat | b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2

General

Target

b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe
Size

122KB
MD5

1ee06211e754214abe9af879e04cde4f
SHA1

473fa0b148d4964e73afeb0fec2997952d5204df
SHA256

b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2
SHA512

71818bd05be08f4af4ad6e81ad8eecd248181f55ebfe2923fd372c073bf1d6acc395dedf5638da4ea36a26f9313c121a152c7afc36a12262f9a1c7013f2f326a
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLVgHe:P5eznsjsguGDFqGZ2rDL4e

Score

10^/10

njrat neuf defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2460	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe

Executes dropped EXE 2 IoCs

pid	Process
5176	chargeable.exe
4992	chargeable.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe"	b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5176 set thread context of 4992	5176	chargeable.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe
Token: 33	4992	chargeable.exe
Token: SeIncBasePriorityPrivilege	4992	chargeable.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 5176	532	b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe	94
PID 532 wrote to memory of 5176	532	b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe	94
PID 532 wrote to memory of 5176	532	b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe	94
PID 5176 wrote to memory of 4992	5176	chargeable.exe	97
PID 5176 wrote to memory of 4992	5176	chargeable.exe	97
PID 5176 wrote to memory of 4992	5176	chargeable.exe	97
PID 5176 wrote to memory of 4992	5176	chargeable.exe	97
PID 5176 wrote to memory of 4992	5176	chargeable.exe	97
PID 5176 wrote to memory of 4992	5176	chargeable.exe	97
PID 5176 wrote to memory of 4992	5176	chargeable.exe	97
PID 5176 wrote to memory of 4992	5176	chargeable.exe	97
PID 4992 wrote to memory of 2460	4992	chargeable.exe	98
PID 4992 wrote to memory of 2460	4992	chargeable.exe	98
PID 4992 wrote to memory of 2460	4992	chargeable.exe	98

C:\Users\Admin\AppData\Local\Temp\b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe
"C:\Users\Admin\AppData\Local\Temp\b5111f6c9e024b429fced38c042d06909c67145cba3118905593d24139ce20a2.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:532
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\chargeable.exe.log

Filesize
400B

MD5
0a9b4592cd49c3c21f6767c2dabda92f

SHA1
f534297527ae5ccc0ecb2221ddeb8e58daeb8b74

SHA256
c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd

SHA512
6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

Download Submit
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Filesize
122KB

MD5
904ec32de64bc71a3736cdadf154adca

SHA1
b20259d5992d930f8e042ebe0dd8ca6a023c02dd

SHA256
ba651850e44a01199b1577afa7842a80c1cd218917fdc9939a027085eb828dea

SHA512
31f070252e465e5f85fe52139a87a3d88a1315885707c88a8b9c615b7288ae6135cc766caf15f46afa1eb68a2e0f2d40a52729d0c1f23e05225350e6b5e43852

Download Submit
memory/532-19-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/532-6-0x00000000754E2000-0x00000000754E3000-memory.dmp

Filesize
4KB

Download
memory/532-7-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/532-2-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/532-0-0x00000000754E2000-0x00000000754E3000-memory.dmp

Filesize
4KB

Download
memory/532-1-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/4992-23-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4992-27-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/4992-29-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/5176-20-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/5176-21-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/5176-22-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/5176-28-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads