njrat | 331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe
Size

115KB
MD5

d8ed316684bc6e44b278d43dbe7dfa60
SHA1

5e0644d462e22eec339b65fa3767e66723dc9db3
SHA256

331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7
SHA512

67980a26c708c7c0590471f9cf004f5ceb6e07a01f2d7c71e8d056a9a13da3e6d8d037d48cf94fa2e9f3e60f3747d7d470466c4ca122ec9aeca8c7ca012de93d
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMdedn:P5eznsjsguGDFqGZ2rY

Score

10^/10

njrat neuf evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4424 netsh.exe

pid	process
4424	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe

Executes dropped EXE 3 IoCs

Processes:

chargeable.exechargeable.exechargeable.exe

pid process

2444 chargeable.exe
1392 chargeable.exe
4840 chargeable.exe

pid	process
2444	chargeable.exe
1392	chargeable.exe
4840	chargeable.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe"	331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

chargeable.exe

description pid process target process

PID 2444 set thread context of 1392 2444 chargeable.exe chargeable.exe
PID 2444 set thread context of 4840 2444 chargeable.exe chargeable.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2444 set thread context of 1392	2444	chargeable.exe	chargeable.exe
PID 2444 set thread context of 4840	2444	chargeable.exe	chargeable.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1716 4840 WerFault.exe chargeable.exe

pid	pid_target	process	target process
1716	4840	WerFault.exe	chargeable.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

chargeable.exe

description	pid	process
Token: SeDebugPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe
Token: 33	1392	chargeable.exe
Token: SeIncBasePriorityPrivilege	1392	chargeable.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exechargeable.exechargeable.exe

description	pid	process	target process
PID 3860 wrote to memory of 2444	3860	331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe	chargeable.exe
PID 3860 wrote to memory of 2444	3860	331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe	chargeable.exe
PID 3860 wrote to memory of 2444	3860	331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe	chargeable.exe
PID 2444 wrote to memory of 4840	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 4840	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 4840	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 1392	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 1392	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 1392	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 1392	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 1392	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 1392	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 1392	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 1392	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 4840	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 4840	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 4840	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 4840	2444	chargeable.exe	chargeable.exe
PID 2444 wrote to memory of 4840	2444	chargeable.exe	chargeable.exe
PID 1392 wrote to memory of 4424	1392	chargeable.exe	netsh.exe
PID 1392 wrote to memory of 4424	1392	chargeable.exe	netsh.exe
PID 1392 wrote to memory of 4424	1392	chargeable.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\331a2ebdcf44dbfb9679a19c650b93db429c26f4e4bf21cd8916b8884f876ac7_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3860

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2444

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
3⤵
- Executes dropped EXE
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 80
4⤵
- Program crash
PID:1716

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4840 -ip 4840
1⤵
PID:2620

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\chargeable.exe.log
Filesize
400B

MD5
0a9b4592cd49c3c21f6767c2dabda92f

SHA1
f534297527ae5ccc0ecb2221ddeb8e58daeb8b74

SHA256
c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd

SHA512
6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

Download Submit
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
Filesize
115KB

MD5
cefa4d858ec0e6338b98c971fe4881c5

SHA1
bc684a76bbdbaa77b50fac03691bf9a3693ca973

SHA256
edd26ac60e03533328253c3a85f213d20dc1f884cde0caaa53ac4fbe2db360e5

SHA512
e686d79beb2dcab4f7434c8c1e429babea168710c06fd122cc2c0b39c33246b387375d317b25afda91306d4750f7e62ce4acd0b76a9d5e93c0c858e435b5f301

Download Submit
memory/1392-28-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/1392-20-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1392-26-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/1392-29-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/2444-17-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/2444-19-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/2444-27-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/3860-2-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/3860-18-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/3860-1-0x0000000074D20000-0x00000000752D1000-memory.dmp

Filesize
5.7MB

Download
memory/3860-0-0x0000000074D22000-0x0000000074D23000-memory.dmp

Filesize
4KB

Download