njrat | ed6398ae88f980ec67453283ae2087086f98236250e7fe1d071fa39d0b0f966e

General

Target

68e05f32c339585c1d415c35d805245f_JaffaCakes118.exe
Size

72KB
MD5

68e05f32c339585c1d415c35d805245f
SHA1

d6917a7251b868bf957c12b8f3c03640f55b79c4
SHA256

ed6398ae88f980ec67453283ae2087086f98236250e7fe1d071fa39d0b0f966e
SHA512

aee88d6406b8c7e6453fb236940adb25f0164ea53ee81256a30303610c4821bd47eac86aa5d2e795f700801c6d7f9b43f2ee1995de7caa80c5dd5b6ac02fdcb3
SSDEEP

1536:D3eJG53G73mxdvddLYh7TYOVZkH+qYPTkU:D32GhNvzYhNu+qKkU

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

cookiemac.ddns.net:1177

Mutex

2e9be554f9032c4fbb4dfe992747084c

Attributes

reg_key
2e9be554f9032c4fbb4dfe992747084c
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3588 netsh.exe

pid	process
3588	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

68e05f32c339585c1d415c35d805245f_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	68e05f32c339585c1d415c35d805245f_JaffaCakes118.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2e9be554f9032c4fbb4dfe992747084c.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2e9be554f9032c4fbb4dfe992747084c.exe	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

3532 svchost.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

3 pastebin.com
4 pastebin.com
20 pastebin.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3532	svchost.exe

flow	ioc
3	pastebin.com
4	pastebin.com
20	pastebin.com

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

68e05f32c339585c1d415c35d805245f_JaffaCakes118.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3096	68e05f32c339585c1d415c35d805245f_JaffaCakes118.exe
Token: SeDebugPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe
Token: 33	3532	svchost.exe
Token: SeIncBasePriorityPrivilege	3532	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

68e05f32c339585c1d415c35d805245f_JaffaCakes118.exesvchost.exe

description	pid	process	target process
PID 3096 wrote to memory of 3532	3096	68e05f32c339585c1d415c35d805245f_JaffaCakes118.exe	svchost.exe
PID 3096 wrote to memory of 3532	3096	68e05f32c339585c1d415c35d805245f_JaffaCakes118.exe	svchost.exe
PID 3096 wrote to memory of 3532	3096	68e05f32c339585c1d415c35d805245f_JaffaCakes118.exe	svchost.exe
PID 3532 wrote to memory of 3588	3532	svchost.exe	netsh.exe
PID 3532 wrote to memory of 3588	3532	svchost.exe	netsh.exe
PID 3532 wrote to memory of 3588	3532	svchost.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\68e05f32c339585c1d415c35d805245f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68e05f32c339585c1d415c35d805245f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:3588

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
72KB

MD5
68e05f32c339585c1d415c35d805245f

SHA1
d6917a7251b868bf957c12b8f3c03640f55b79c4

SHA256
ed6398ae88f980ec67453283ae2087086f98236250e7fe1d071fa39d0b0f966e

SHA512
aee88d6406b8c7e6453fb236940adb25f0164ea53ee81256a30303610c4821bd47eac86aa5d2e795f700801c6d7f9b43f2ee1995de7caa80c5dd5b6ac02fdcb3

Download Submit
memory/3096-0-0x000000007461E000-0x000000007461F000-memory.dmp

Filesize
4KB

Download
memory/3096-1-0x00000000005E0000-0x00000000005F8000-memory.dmp

Filesize
96KB

Download
memory/3096-2-0x0000000005530000-0x0000000005AD4000-memory.dmp

Filesize
5.6MB

Download
memory/3096-3-0x0000000005020000-0x00000000050B2000-memory.dmp

Filesize
584KB

Download
memory/3096-4-0x00000000050C0000-0x000000000515C000-memory.dmp

Filesize
624KB

Download
memory/3096-5-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/3096-6-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download
memory/3096-7-0x0000000007280000-0x000000000728C000-memory.dmp

Filesize
48KB

Download
memory/3096-20-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download
memory/3532-21-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download
memory/3532-23-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads