njrat | 1dc3708b2e283b9738c1bedd5a985d92b5719b25ac7e48246a105ef5584e6937

General

Target
dsfsdf.exe
Size 8.1MB
Sample261013-vraycsxt7m
SHA256 1dc3708b2e283b9738c1bedd5a985d92b5719b25ac7e48246a105ef5584e6937
MD5 490f5ffecfd07f973ae2374fd7aa526c
SHA1 9099ec1af5552c01a99c9c1081837df76ea068be
SHA512 3b45c77f66e1a9e830685ff2b39bb9b1bd429245a95b81e8ca7da4004bb097d32324e970b77c59fdc37452667af3c9b55434fc5c9cab8a85f87977d6d4a0aad7
SSDEEP 1536:hNAKeKO2ws2Dnz32BSOuCGKRNZ1+2XZQFNM2RIIik:hNAKe5FJ7UECGe+k2Fi2xp
TLSH
T1FD86BE12FE40A0E2EF6100B02535CB5BCDBE78305B78E4DBBBC44B296E257D5667C922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacked defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

31.6.50.206:2010

Mutex

11cbca363ffbc0ce7f298cb50e185cfc

Attributes

reg_key
11cbca363ffbc0ce7f298cb50e185cfc
splitter
|'|'|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4912 created 3164	4912	dsfsdf.exe	54

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4536	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1408	TeamsUpdate.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	TeamsUpdate.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dsfsdf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	TeamsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TeamsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dsfsdf.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dsfsdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamsUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4912	dsfsdf.exe
4912	dsfsdf.exe
4912	dsfsdf.exe
4912	dsfsdf.exe
4912	dsfsdf.exe
4912	dsfsdf.exe
4912	dsfsdf.exe
4912	dsfsdf.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	TeamsUpdate.exe
Token: 33	1408	TeamsUpdate.exe
Token: SeIncBasePriorityPrivilege	1408	TeamsUpdate.exe
Token: 33	1408	TeamsUpdate.exe
Token: SeIncBasePriorityPrivilege	1408	TeamsUpdate.exe
Token: 33	1408	TeamsUpdate.exe
Token: SeIncBasePriorityPrivilege	1408	TeamsUpdate.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1408	4912	dsfsdf.exe	82
PID 1408 wrote to memory of 4536	1408	TeamsUpdate.exe	83

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3164
- C:\Users\Admin\AppData\Local\Temp\dsfsdf.exe
  "C:\Users\Admin\AppData\Local\Temp\dsfsdf.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4912
- C:\Users\Admin\AppData\Roaming\Microsoft\TeamsUpdate.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\TeamsUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\TeamsUpdate.exe" "TeamsUpdate.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Access Token Manipulation

1

T1134

Parent PID Spoofing

1

T1134.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Access Token Manipulation

1

T1134

Parent PID Spoofing

1

T1134.004

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Peripheral Device Discovery

1

T1120

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Video Capture

1

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TeamsUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\TeamsUpdate.exe
Size 23KB
SHA256 8087cfa0c3842023b68125c3d7b819e62309334e8ca7281dc3f8c8a3be94fc93
MD5 bcacc51c449a36a46281c1806453f867
SHA1 67744926004e6f3b243b7434f0a02f44367963d9
SHA512 181bde68bff44327a86a24a384778ed654bc89ef8fb821068df5e0857da3dab249daad1017ec0577ddda383241a9663e1cc639d55ca4df32fd7df3712dbe7967
SSDEEP 384:hYmCsg/yJrQ7hucGSl7UJx4g6JgfCcosjddmRvR6JZlbw8hqIusZzZOrVy:2rG0Btl7rRpcnuTE
TLSH
T14EB22B0E3FB98896C5AC1B7486A5565003B4A1870463EE2FCCC554DBAFB3BD91D4CAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1408-7-0x0000000074B01000-0x0000000074B02000-memory.dmp

Download

memory/1408-8-0x0000000074B00000-0x00000000750B1000-memory.dmp

Download

memory/1408-9-0x0000000074B00000-0x00000000750B1000-memory.dmp

Download

memory/1408-10-0x0000000074B00000-0x00000000750B1000-memory.dmp

Download

memory/1408-11-0x0000000074B00000-0x00000000750B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads