njrat | f816cf3c16d0925ccc3bcde9e7e01c80c4aa7f675595fcb6b599213cb4805de1

Analysis

max time kernel
139s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4701184e44814ce10db47e9adf55088b_JaffaCakes118.exe
Size

134KB
MD5

4701184e44814ce10db47e9adf55088b
SHA1

658c1444f95ecb3930cb490368421eb0f2ec2b6a
SHA256

f816cf3c16d0925ccc3bcde9e7e01c80c4aa7f675595fcb6b599213cb4805de1
SHA512

db609061362e4319bcea52b9d073b7461fbc5156e4fe0b19fa9d840f1de5f95466137f5ec392a9beac5024040f905fdf5357121e81afe57a7cf1845e2d161045
SSDEEP

3072:/RizzKqY6rDC+tYw3RFa2je49OYwERuHTOUoRe:/Ri7/C+SQRgj4MHTOD

Score

10^/10

njrat تم الاختراق من قبل دكتور الغربية #agilenet trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

تم الاختراق من قبل دكتور الغربية #

Dr187.ddns.net:999

Mutex

59e66e4fd01ed7a53bb65713760bdb7d

Attributes

reg_key
59e66e4fd01ed7a53bb65713760bdb7d
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4701184e44814ce10db47e9adf55088b_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	4701184e44814ce10db47e9adf55088b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

Google Root.exe

pid process

4300 Google Root.exe

pid	process
4300	Google Root.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4324-0-0x0000000000070000-0x0000000000098000-memory.dmp	agile_net
C:\Users\Admin\AppData\Local\Temp\Google Root.exe	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

4701184e44814ce10db47e9adf55088b_JaffaCakes118.exe

description	pid	process	target process
PID 4324 wrote to memory of 4300	4324	4701184e44814ce10db47e9adf55088b_JaffaCakes118.exe	Google Root.exe
PID 4324 wrote to memory of 4300	4324	4701184e44814ce10db47e9adf55088b_JaffaCakes118.exe	Google Root.exe

C:\Users\Admin\AppData\Local\Temp\4701184e44814ce10db47e9adf55088b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4701184e44814ce10db47e9adf55088b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\Google Root.exe
  "C:\Users\Admin\AppData\Local\Temp\Google Root.exe"
  2⤵
  - Executes dropped EXE
  PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Google Root.exe

Filesize
134KB

MD5
4701184e44814ce10db47e9adf55088b

SHA1
658c1444f95ecb3930cb490368421eb0f2ec2b6a

SHA256
f816cf3c16d0925ccc3bcde9e7e01c80c4aa7f675595fcb6b599213cb4805de1

SHA512
db609061362e4319bcea52b9d073b7461fbc5156e4fe0b19fa9d840f1de5f95466137f5ec392a9beac5024040f905fdf5357121e81afe57a7cf1845e2d161045

Download Submit
memory/4300-17-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4300-19-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4324-0-0x0000000000070000-0x0000000000098000-memory.dmp

Filesize
160KB

Download
memory/4324-1-0x00007FFBF0A03000-0x00007FFBF0A05000-memory.dmp

Filesize
8KB

Download
memory/4324-2-0x0000000000940000-0x000000000094C000-memory.dmp

Filesize
48KB

Download
memory/4324-4-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4324-18-0x00007FFBF0A00000-0x00007FFBF14C1000-memory.dmp

Filesize
10.8MB

Download