njrat | 23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe
Size

116KB
MD5

2737c53913dd38330d8c2056d1ddcf9d
SHA1

e3ebe5427b45eb6c94fecb39e514e8bf526f5611
SHA256

23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825
SHA512

61e94d8f2b23451a733d8fcd06c014ea9c922ae6e8ced5eff92c2f3917563a7e36d09b575bdd7c9d76a5a071bf99c8b99f148eb2dd24966ac8cd32c72b9c6b2a
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLk:P5eznsjsguGDFqGZ2rDLk

Score

10^/10

njrat neuf evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1696 netsh.exe
Executes dropped EXE 2 IoCs

Processes:

chargeable.exechargeable.exe

pid process

2000 chargeable.exe
2116 chargeable.exe
Loads dropped DLL 2 IoCs

Processes:

23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe

pid process

2196 23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe
2196 23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe

pid	process
1696	netsh.exe

pid	process
2000	chargeable.exe
2116	chargeable.exe

pid	process
2196	23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe
2196	23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe"	23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chargeable.exe

description pid process target process

PID 2000 set thread context of 2116 2000 chargeable.exe chargeable.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2000 set thread context of 2116	2000	chargeable.exe	chargeable.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

chargeable.exe

description	pid	process
Token: SeDebugPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe
Token: 33	2116	chargeable.exe
Token: SeIncBasePriorityPrivilege	2116	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exechargeable.exechargeable.exe

description	pid	process	target process
PID 2196 wrote to memory of 2000	2196	23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe	chargeable.exe
PID 2196 wrote to memory of 2000	2196	23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe	chargeable.exe
PID 2196 wrote to memory of 2000	2196	23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe	chargeable.exe
PID 2196 wrote to memory of 2000	2196	23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe	chargeable.exe
PID 2000 wrote to memory of 2116	2000	chargeable.exe	chargeable.exe
PID 2000 wrote to memory of 2116	2000	chargeable.exe	chargeable.exe
PID 2000 wrote to memory of 2116	2000	chargeable.exe	chargeable.exe
PID 2000 wrote to memory of 2116	2000	chargeable.exe	chargeable.exe
PID 2000 wrote to memory of 2116	2000	chargeable.exe	chargeable.exe
PID 2000 wrote to memory of 2116	2000	chargeable.exe	chargeable.exe
PID 2000 wrote to memory of 2116	2000	chargeable.exe	chargeable.exe
PID 2000 wrote to memory of 2116	2000	chargeable.exe	chargeable.exe
PID 2000 wrote to memory of 2116	2000	chargeable.exe	chargeable.exe
PID 2116 wrote to memory of 1696	2116	chargeable.exe	netsh.exe
PID 2116 wrote to memory of 1696	2116	chargeable.exe	netsh.exe
PID 2116 wrote to memory of 1696	2116	chargeable.exe	netsh.exe
PID 2116 wrote to memory of 1696	2116	chargeable.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe
"C:\Users\Admin\AppData\Local\Temp\23294d2bf23f047f2d77343e177c77fdf5814d357a9fc748c20e7c945e18d825.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2196

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1696

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d20b89835023c884c596004b9e72cf39

SHA1
295fc9d1e3698ccdef3c13de23486dbf5c72d903

SHA256
c98efedd10dc7171047e5b6e9180da88361672ea369ee6bda59d001cd58676a0

SHA512
1a5665f5ca7032e41d7b35f9f95998948a37019db857a105b412ac203b14f5e77f380c366db682ffbf00a2dc006e7d50636cf3e528429f4d3034d39140b232e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
412340d8d120cd4036a07a63f97e2533

SHA1
5801469006b051183bc105f9132b043ee591291b

SHA256
0f8515afb035b3eecdcc114147935e2b7e959e1da9faaf749f06d43551acc3a5

SHA512
6a497ce5949468fe342fd4fba75d66152d7f430c9e6172904e3669e255fd3461843ddd209ebf069398f2eeb6a055940ae79481b7f7939cb340be6dc52e1d82de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b0377d2dd78d5358d72a8c0010f08f7e

SHA1
d80ce09200bd3b46a9103c20c5215f43e6abff19

SHA256
687f3df65787792ff11982c48f75fa941851d895644c2566436d93a7b79f34f8

SHA512
b856ff2a90d21332db1873e2d446b5fd8ec60e065c680a2eba72e55746e06766217b991f72b3cb89dce201de3e8a5a002b7e9bf78e132041e6328fc0757e6a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F80.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FA2.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Roaming\confuse\chargeable.exe
Filesize
117KB

MD5
23ee8fdc50341811b895375f16e42f45

SHA1
605b2cbc7f9ee76ee128946d6e39e938056fc399

SHA256
5c529ce2c046f8534e2eba1f9a78719a30e246fafeb6d3bbcf2590b09185d212

SHA512
a32b322798a042ced7a94bb3bcb14b51c35caf8a09aa488128a13bfe84d9db290f8d62c6379bf958ffd0f80187906cb3b7d28faae0cfde66b8ff019eda22ef56

Download Submit
memory/2116-284-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-287-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-286-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2196-110-0x0000000074A20000-0x0000000074FCB000-memory.dmp

Filesize
5.7MB

Download
memory/2196-120-0x0000000074A20000-0x0000000074FCB000-memory.dmp

Filesize
5.7MB

Download
memory/2196-0-0x0000000074A21000-0x0000000074A22000-memory.dmp

Filesize
4KB

Download
memory/2196-1-0x0000000074A20000-0x0000000074FCB000-memory.dmp

Filesize
5.7MB

Download