njrat | 85c2d210b1aecb5743c097ef93941ed5383d11df0a18f8303437906bed8f02e8

General

Target

fbfab3f0db5067f3e8aae218d5752c3a_JaffaCakes118.exe
Size

295KB
MD5

fbfab3f0db5067f3e8aae218d5752c3a
SHA1

4112713473652324d65554aad800fc159c45a4e6
SHA256

85c2d210b1aecb5743c097ef93941ed5383d11df0a18f8303437906bed8f02e8
SHA512

ab781b73fbb3e8c1ad04a5fbba415a5deebfd7bac391f3ae30c4f7ce078d5ecc083ff7ed39778efe67d6cbc93610c967054f5621ff6c0f8c70f5a1a16117fa5e
SSDEEP

3072:gyNx+ONJItfWA3VqDO3+YCYkQZOr/V8Z451u/WCWoTrAyA8kzNYQdrsjA7WGpyPb:FNxPYfWA4jYfoL

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2708	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
3028	volcano.exe

Loads dropped DLL 1 IoCs

pid	Process
2916	fbfab3f0db5067f3e8aae218d5752c3a_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\12a70dbbad804cf052de6d917a15313c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\volcano.exe\" .."	volcano.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\12a70dbbad804cf052de6d917a15313c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\volcano.exe\" .."	volcano.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe
Token: 33	3028	volcano.exe
Token: SeIncBasePriorityPrivilege	3028	volcano.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3028	2916	fbfab3f0db5067f3e8aae218d5752c3a_JaffaCakes118.exe	28
PID 2916 wrote to memory of 3028	2916	fbfab3f0db5067f3e8aae218d5752c3a_JaffaCakes118.exe	28
PID 2916 wrote to memory of 3028	2916	fbfab3f0db5067f3e8aae218d5752c3a_JaffaCakes118.exe	28
PID 2916 wrote to memory of 3028	2916	fbfab3f0db5067f3e8aae218d5752c3a_JaffaCakes118.exe	28
PID 3028 wrote to memory of 2708	3028	volcano.exe	29
PID 3028 wrote to memory of 2708	3028	volcano.exe	29
PID 3028 wrote to memory of 2708	3028	volcano.exe	29
PID 3028 wrote to memory of 2708	3028	volcano.exe	29

C:\Users\Admin\AppData\Local\Temp\fbfab3f0db5067f3e8aae218d5752c3a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbfab3f0db5067f3e8aae218d5752c3a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\volcano.exe
  "C:\Users\Admin\AppData\Local\Temp\volcano.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\volcano.exe" "volcano.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\volcano.exe

Filesize
295KB

MD5
fbfab3f0db5067f3e8aae218d5752c3a

SHA1
4112713473652324d65554aad800fc159c45a4e6

SHA256
85c2d210b1aecb5743c097ef93941ed5383d11df0a18f8303437906bed8f02e8

SHA512
ab781b73fbb3e8c1ad04a5fbba415a5deebfd7bac391f3ae30c4f7ce078d5ecc083ff7ed39778efe67d6cbc93610c967054f5621ff6c0f8c70f5a1a16117fa5e

Download Submit
memory/2916-0-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/2916-1-0x00000000008E0000-0x0000000000920000-memory.dmp

Filesize
256KB

Download
memory/2916-2-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/2916-10-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/3028-11-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/3028-12-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download
memory/3028-13-0x0000000000750000-0x0000000000790000-memory.dmp

Filesize
256KB

Download
memory/3028-14-0x00000000743A0000-0x000000007494B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads