njrat | 3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe
Size

115KB
MD5

383e72d71229bb87b38e14d929cab340
SHA1

2eb58cd202b71b15e07be035131fde5069908bbf
SHA256

3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518
SHA512

e573eb6204aae5dd21148f5b3f02b4ef2ce4b0249bfd51521bf8a93390ce667c3fc6fb10479dc6b6855da0a538833d96caaf774de1f1a18f98d18b95784d1655
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMI9:P5eznsjsguGDFqGZ2rI9

Score

10^/10

njrat neuf evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2616 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

chargeable.exechargeable.exe

pid process

836 chargeable.exe
2648 chargeable.exe
Loads dropped DLL 2 IoCs

Processes:

3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe

pid process

1960 3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe
1960 3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe

pid	process
2616	netsh.exe

pid	process
836	chargeable.exe
2648	chargeable.exe

pid	process
1960	3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe
1960	3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe"	3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chargeable.exe

description pid process target process

PID 836 set thread context of 2648 836 chargeable.exe chargeable.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 836 set thread context of 2648	836	chargeable.exe	chargeable.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

chargeable.exe

description	pid	process
Token: SeDebugPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe
Token: 33	2648	chargeable.exe
Token: SeIncBasePriorityPrivilege	2648	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exechargeable.exechargeable.exe

description	pid	process	target process
PID 1960 wrote to memory of 836	1960	3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe	chargeable.exe
PID 1960 wrote to memory of 836	1960	3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe	chargeable.exe
PID 1960 wrote to memory of 836	1960	3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe	chargeable.exe
PID 1960 wrote to memory of 836	1960	3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe	chargeable.exe
PID 836 wrote to memory of 2648	836	chargeable.exe	chargeable.exe
PID 836 wrote to memory of 2648	836	chargeable.exe	chargeable.exe
PID 836 wrote to memory of 2648	836	chargeable.exe	chargeable.exe
PID 836 wrote to memory of 2648	836	chargeable.exe	chargeable.exe
PID 836 wrote to memory of 2648	836	chargeable.exe	chargeable.exe
PID 836 wrote to memory of 2648	836	chargeable.exe	chargeable.exe
PID 836 wrote to memory of 2648	836	chargeable.exe	chargeable.exe
PID 836 wrote to memory of 2648	836	chargeable.exe	chargeable.exe
PID 836 wrote to memory of 2648	836	chargeable.exe	chargeable.exe
PID 2648 wrote to memory of 2616	2648	chargeable.exe	netsh.exe
PID 2648 wrote to memory of 2616	2648	chargeable.exe	netsh.exe
PID 2648 wrote to memory of 2616	2648	chargeable.exe	netsh.exe
PID 2648 wrote to memory of 2616	2648	chargeable.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3a511299e856e13fd9e431eae5fde5a0815ffb37fce88132f98872540f05c518_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2616

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956
Filesize
1KB

MD5
fc1193c6345ac35188aa3de0f824ceb7

SHA1
8fb5606f5380ac6ace7bb4e7c71b6750362e8c5f

SHA256
bdfb8faff4c0c0a15c642890a5544bd32f930f55ca199470dbd4736a32d6e200

SHA512
480a3ad52cf215db3cede6ad93293f8f031c2cb7a190c6f4cbcd0f3eb06f5c81c7f13d304a495945192e759ab5403245acef7be0149b8615ce2b194927f3dec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d0855a85a3adb80803905f352640e6d5

SHA1
28efb40239753654e811d6ea61afb3a70e0dae3c

SHA256
8422448025db8f1e682ae1b8c42c9ddf2cbd5e9d29aa89aad5231a99822002cc

SHA512
8510c180d81ee1363abf70f66bbc1bcd9dd0be1a56357b20ede54a5b57385eb1ca9a2662be88f9a30fec391e09f17673a4fc1c95afc1aa09cf70ef209690e784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
54ee241d1b186660b0a9d5376f020fbe

SHA1
48232989b57482d94fd3550fdd7e01da7be27183

SHA256
06377d0382b69bb401b6c2125ae2c34e7a076c6b5aa54514970b7761c79ce828

SHA512
ae46de51e593e415430025f1d473261ea56855d4deced03d98742587f39d3c98d571a45f683a1526c909bfa8b310841119825360affca8c0e448552389662d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c02c528975b50ae2989e88ec415176fd

SHA1
0e2c0126625250b03307f841611c421a558d23b0

SHA256
0d2f1faf6ac4720f9c819ee4f62a149a6ac4896d60e521ace30cc61b0560f0b3

SHA512
047a11ccee9ff9d86bcb2dd61d33d029134d557a75e1105c93ec50d1853ac88581ecde46306a6427b479fa9f5d5069f25ee67ab1bc5dcb6a3679b9b80b3442ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956
Filesize
252B

MD5
b180656a888c73c1a2fc92d02d0332db

SHA1
3f7960f8018737ff9f17d7b5c2319a0cb11f0025

SHA256
19aebf924768d4a9436a9ceb17b2fd416bac1373b1b17bd84c36f175031f95de

SHA512
15717bfeda97d150bf37c057ccf43470444edf0669404a4ed88a74056e25bb3ee1985da5b3f98b99f234a35d45d90e687c1d107fb30432649cbddcc7e2b0a52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab252F.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2541.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2683.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Roaming\confuse\chargeable.exe
Filesize
115KB

MD5
de4a4be5a369213576b2a0ae31b9bbb1

SHA1
3ba8d86d5d8768e0395803f3b2c444115221695b

SHA256
4a0d3c83b604436689b11e3332cafd3e004284c543e3ecf79c59bcc0e19fc8bf

SHA512
daf5b09a9a9bc476863887c0436928341fcfdb5235e0eb91e3550309f88c9a2228fb172f76a59b095361980b217c7c0268028f4ad364b1f8d50ab92017a43de8

Download Submit
memory/1960-193-0x00000000748A0000-0x0000000074E4B000-memory.dmp

Filesize
5.7MB

Download
memory/1960-1-0x00000000748A0000-0x0000000074E4B000-memory.dmp

Filesize
5.7MB

Download
memory/1960-0-0x00000000748A1000-0x00000000748A2000-memory.dmp

Filesize
4KB

Download
memory/2648-360-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2648-363-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2648-362-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download