njrat | 6364c2d78caedd5950f0e827e3595e38db21e17b5ffd6ecef2c513abf03403fe

General

Target

f4c92096d53617c613ae27b5b567e01b_JaffaCakes118.exe
Size

1.0MB
MD5

f4c92096d53617c613ae27b5b567e01b
SHA1

0d0ec8e0403716a9daff7d475ee360c6433e3b36
SHA256

6364c2d78caedd5950f0e827e3595e38db21e17b5ffd6ecef2c513abf03403fe
SHA512

4960404aa688fcc21926b8357bdb1cdbbeb70e49d2e0f5739faf384de56cff0afcc5e948462b99f568b5d25a7bd4556662ea3d6c695a271e031d8241becb757a
SSDEEP

3072:1tU5R9DLoDWTCIMSpCZGKY8eW5DRQOcPDH80XCJ3rFzg7fabVKQULzXKcAyorvab:M9YDwfKD0Jxn

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

279f6960ed84a752570aca7fb2dc1552

Attributes

reg_key
279f6960ed84a752570aca7fb2dc1552
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2592 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

2848 server.exe

pid	process
2592	netsh.exe

pid	process
2848	server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe
Token: 33	2848	server.exe
Token: SeIncBasePriorityPrivilege	2848	server.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f4c92096d53617c613ae27b5b567e01b_JaffaCakes118.exeserver.exe

description	pid	process	target process
PID 2948 wrote to memory of 2848	2948	f4c92096d53617c613ae27b5b567e01b_JaffaCakes118.exe	server.exe
PID 2948 wrote to memory of 2848	2948	f4c92096d53617c613ae27b5b567e01b_JaffaCakes118.exe	server.exe
PID 2948 wrote to memory of 2848	2948	f4c92096d53617c613ae27b5b567e01b_JaffaCakes118.exe	server.exe
PID 2848 wrote to memory of 2592	2848	server.exe	netsh.exe
PID 2848 wrote to memory of 2592	2848	server.exe	netsh.exe
PID 2848 wrote to memory of 2592	2848	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\f4c92096d53617c613ae27b5b567e01b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4c92096d53617c613ae27b5b567e01b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\system32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:2592

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe
Filesize
1.0MB

MD5
f4c92096d53617c613ae27b5b567e01b

SHA1
0d0ec8e0403716a9daff7d475ee360c6433e3b36

SHA256
6364c2d78caedd5950f0e827e3595e38db21e17b5ffd6ecef2c513abf03403fe

SHA512
4960404aa688fcc21926b8357bdb1cdbbeb70e49d2e0f5739faf384de56cff0afcc5e948462b99f568b5d25a7bd4556662ea3d6c695a271e031d8241becb757a

Download Submit
memory/2848-11-0x0000000000380000-0x0000000000486000-memory.dmp

Filesize
1.0MB

Download
memory/2848-13-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2848-14-0x00000000006B0000-0x0000000000730000-memory.dmp

Filesize
512KB

Download
memory/2848-15-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2948-0-0x0000000000A20000-0x0000000000B26000-memory.dmp

Filesize
1.0MB

Download
memory/2948-1-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2948-2-0x00000000003F0000-0x0000000000420000-memory.dmp

Filesize
192KB

Download
memory/2948-3-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/2948-12-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads