njrat | 7fb87752aa967175954cabb56e4aac86abb5d8fc9d4f2ae4b3ec5a272ac66d7e

General

Target

65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe
Size

23KB
MD5

65b6faaeae4305f6c648465eed531f63
SHA1

3ebdd9346972b7e1f0ab61e9eeb004d4c3bfd8f0
SHA256

7fb87752aa967175954cabb56e4aac86abb5d8fc9d4f2ae4b3ec5a272ac66d7e
SHA512

d587552556dc5d6d8d70cc4abc89f62ac9f187edc890180f9675412e1ec06cb4f5e2a88fe39273f7e73cca10597b9243b7a59484a8d22cf745b5574f6b5bc837
SSDEEP

384:Qc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZVa65:Ee9EJLN/yRpcnuK

Score

10^/10

njrat ashraf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

ashraf

C2

nsoorkarbala.ddns.net:1177

Mutex

e40ea9a7a3b853de9c126097dc3606ed

Attributes

reg_key
e40ea9a7a3b853de9c126097dc3606ed
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2816 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

google.exe

pid process

2252 google.exe
Loads dropped DLL 1 IoCs

Processes:

65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe

pid process

1796 65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe

pid	process
2816	netsh.exe

pid	process
2252	google.exe

pid	process
1796	65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

google.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\e40ea9a7a3b853de9c126097dc3606ed = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .."	google.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\e40ea9a7a3b853de9c126097dc3606ed = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .."	google.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

google.exe

description	pid	process
Token: SeDebugPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe
Token: 33	2252	google.exe
Token: SeIncBasePriorityPrivilege	2252	google.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exegoogle.exe

description	pid	process	target process
PID 1796 wrote to memory of 2252	1796	65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe	google.exe
PID 1796 wrote to memory of 2252	1796	65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe	google.exe
PID 1796 wrote to memory of 2252	1796	65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe	google.exe
PID 1796 wrote to memory of 2252	1796	65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe	google.exe
PID 2252 wrote to memory of 2816	2252	google.exe	netsh.exe
PID 2252 wrote to memory of 2816	2252	google.exe	netsh.exe
PID 2252 wrote to memory of 2816	2252	google.exe	netsh.exe
PID 2252 wrote to memory of 2816	2252	google.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65b6faaeae4305f6c648465eed531f63_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\google.exe
  "C:\Users\Admin\AppData\Local\Temp\google.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\google.exe" "google.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\google.exe

Filesize
23KB

MD5
65b6faaeae4305f6c648465eed531f63

SHA1
3ebdd9346972b7e1f0ab61e9eeb004d4c3bfd8f0

SHA256
7fb87752aa967175954cabb56e4aac86abb5d8fc9d4f2ae4b3ec5a272ac66d7e

SHA512
d587552556dc5d6d8d70cc4abc89f62ac9f187edc890180f9675412e1ec06cb4f5e2a88fe39273f7e73cca10597b9243b7a59484a8d22cf745b5574f6b5bc837

Download Submit
memory/1796-0-0x0000000074DA1000-0x0000000074DA2000-memory.dmp

Filesize
4KB

Download
memory/1796-1-0x0000000074DA0000-0x000000007534B000-memory.dmp

Filesize
5.7MB

Download
memory/1796-2-0x0000000074DA0000-0x000000007534B000-memory.dmp

Filesize
5.7MB

Download
memory/1796-11-0x0000000074DA0000-0x000000007534B000-memory.dmp

Filesize
5.7MB

Download
memory/2252-12-0x0000000074DA0000-0x000000007534B000-memory.dmp

Filesize
5.7MB

Download
memory/2252-10-0x0000000074DA0000-0x000000007534B000-memory.dmp

Filesize
5.7MB

Download
memory/2252-13-0x0000000074DA0000-0x000000007534B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads