njrat | 3e647892191594cfc6715d9c6e59f4bc97f8c44e83bec42e71eac792bc97e7f9

Reason

Machine shutdown

General

Target
Payload_Slayed.exe
Size 53KB
Sample261107-bckdpsgv2v
SHA256 3e647892191594cfc6715d9c6e59f4bc97f8c44e83bec42e71eac792bc97e7f9
MD5 a6c54fad6de5293cf09941e8f6189a97
SHA1 58a467b5cad4cee944e00dc8c332694f31e71a8f
SHA512 bf5ab80f7701a460d02c9f51f4ddc66fa20a4a4e313e88d812287a57af35bcda925002735b91617461c04d3d7340ae32320469756dab663dbc8bb1edfc55e1c9
SSDEEP 1536:kKGOf5NgvFjEmXt6j6F8PQuIDxXExI3pmEm:KOqFjEmXA+8PQuIDxXExI3pm
TLSH
T172334944BFEA5A01E2BD8F7458B995150A34FA23E532D71E48D668DB13337C49C88FE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution njrat trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Payload_Slayed.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2128	cmd.exe
1296	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Payload_Slayed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Payload_Slayed.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload_Slayed.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4968	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "255"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	5716	Payload_Slayed.exe
Token: 33	5716	Payload_Slayed.exe
Token: SeIncBasePriorityPrivilege	5716	Payload_Slayed.exe
Token: 33	5716	Payload_Slayed.exe
Token: SeIncBasePriorityPrivilege	5716	Payload_Slayed.exe
Token: 33	5716	Payload_Slayed.exe
Token: SeIncBasePriorityPrivilege	5716	Payload_Slayed.exe
Token: 33	5716	Payload_Slayed.exe
Token: SeIncBasePriorityPrivilege	5716	Payload_Slayed.exe
Token: 33	5716	Payload_Slayed.exe
Token: SeIncBasePriorityPrivilege	5716	Payload_Slayed.exe
Token: 33	5716	Payload_Slayed.exe
Token: SeIncBasePriorityPrivilege	5716	Payload_Slayed.exe
Token: SeShutdownPrivilege	5320	shutdown.exe
Token: SeRemoteShutdownPrivilege	5320	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4488	LogonUI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5716 wrote to memory of 2128	5716	Payload_Slayed.exe	80
PID 2128 wrote to memory of 4968	2128	cmd.exe	82
PID 5716 wrote to memory of 1296	5716	Payload_Slayed.exe	84
PID 1296 wrote to memory of 5320	1296	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\Payload_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\Payload_Slayed.exe"
1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Wireshark.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Wireshark.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start shutdown /r /f /t 0
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /f /t 0
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5320

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2d055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4488