njrat | 97abbbaaaa039dfd63597398e43bf82c5326f6d101c2c1241edd748dcf4f7c17

General

Target
shnfr.rar
Size 21KB
Sample261022-adbbrabw2k
SHA256 97abbbaaaa039dfd63597398e43bf82c5326f6d101c2c1241edd748dcf4f7c17
MD5 b237e7f9bd116f3e85c126ed1ce8a972
SHA1 0538c4e1f43b99d743cdcb18b50febd2bb7b64f2
SHA512 38808409af4f86935f1a9deb1a7aa50f9c1c73492c3e7b5a350f4a9e43790eeffa76c82806304a1da370317080bd0d72636ec1e805edf2090f5c083fe04adc16
SSDEEP 384:7SEuzTFCULScOti+5j09jdYFX4AGDTaa7FutjJNHN3Zvu5umMCC:7VuzJGcT+EjsoAGDhxuxJdNpmmCC
TLSH
T1A0A2E15EF4115852BC748893688C412C1BCB34FCE82D974392BD597953BD1C9CE5617A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacked defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

33.tcp.cpolar.top:10348

Mutex

c7cfcf47ead79e1a0a3b76abac401571

Attributes

reg_key
c7cfcf47ead79e1a0a3b76abac401571
splitter
|'|'|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4792	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	shnfr.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	shnfr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	shnfr.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shnfr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4500	7zFM.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeRestorePrivilege	4500	7zFM.exe
Token: 35	4500	7zFM.exe
Token: SeSecurityPrivilege	4500	7zFM.exe
Token: SeDebugPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe
Token: 33	4844	shnfr.exe
Token: SeIncBasePriorityPrivilege	4844	shnfr.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4500	7zFM.exe
4500	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4844	4500	7zFM.exe	90
PID 4844 wrote to memory of 4792	4844	shnfr.exe	91

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\shnfr.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\7zO49188AC9\shnfr.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO49188AC9\shnfr.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\7zO49188AC9\shnfr.exe" "shnfr.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shnfr.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO49188AC9\shnfr.exe
Size 37KB
SHA256 ccfd15d144c48d8233a0cca69bbc2cb2f1ba4a690a5a13b856437f72b9a164aa
MD5 cac36aa0929c18ba91cc7114bbe8ffc9
SHA1 6b90431e317b0c15bf0fcfde2fe63dfb76fbc9d2
SHA512 e7759d759ee74d75c8933a08abbd21b37404ef27c3c4886d566d24f71b8fbb3a8c7df4d21eb4d5ce3584770269a1f2ea0443d2cd4ab9163fcaaa9cc5cbb81f7d
SSDEEP 384:ImOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3n:eFdGdkrgYRwWS9rM+rMRa8Nub0t
TLSH
T121032A4D7FE181A8C5FD067B05B2D41207BAE04B6E23DD0E8EE564EA37636C58B50AF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4844-9-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Download

memory/4844-10-0x00000000742F2000-0x00000000742F4000-memory.dmp

Download

memory/4844-11-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Download

memory/4844-12-0x00000000742F2000-0x00000000742F4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads