njrat | f061d3948aece0c1572e9a2cb35a8b747d60e738fe2c739ee599a1b4cbc7234c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe
Size 262KB
Sample240602-kph6vahb29
SHA256 f061d3948aece0c1572e9a2cb35a8b747d60e738fe2c739ee599a1b4cbc7234c
MD5 8d804fd1e20e9776ca65abd0a940d2a0
SHA1 11d4c3e4ed84188d97dffa128e84f800231b336f
SHA512 c5237d030edf1f0b573ff5d09beedb3c763d16491df49ac78d6bb399a303d03ac3f5b4738b9bb5ab72bafaae629fbc0ec3bfcb11fd36be0a01dd93202d8cfcc2
SSDEEP 1536:zdoTsBr4WLgG6xUVhAAp5uReTcLFW9EJLdyRWuJU:zddBr4KgG6xmp5uPwEJLI0p
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3776	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Server.exe

Executes dropped EXE 3 IoCs

pid	Process
2596	KNVPN_Installer (1).exe
5040	Server.exe
404	server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5a690a2d85416472d1035f56a009c256 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5a690a2d85416472d1035f56a009c256 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .."	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe
Token: 33	404	server.exe
Token: SeIncBasePriorityPrivilege	404	server.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 2596	216	8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe	86
PID 216 wrote to memory of 2596	216	8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe	86
PID 216 wrote to memory of 2596	216	8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe	86
PID 216 wrote to memory of 5040	216	8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe	87
PID 216 wrote to memory of 5040	216	8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe	87
PID 216 wrote to memory of 5040	216	8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe	87
PID 5040 wrote to memory of 404	5040	Server.exe	93
PID 5040 wrote to memory of 404	5040	Server.exe	93
PID 5040 wrote to memory of 404	5040	Server.exe	93
PID 404 wrote to memory of 3776	404	server.exe	96
PID 404 wrote to memory of 3776	404	server.exe	96
PID 404 wrote to memory of 3776	404	server.exe	96

C:\Users\Admin\AppData\Local\Temp\8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8d804fd1e20e9776ca65abd0a940d2a0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\KNVPN_Installer (1).exe
  "C:\Users\Admin\AppData\Local\Temp\KNVPN_Installer (1).exe"
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Users\Admin\AppData\Roaming\server.exe
    "C:\Users\Admin\AppData\Roaming\server.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log
Size 319B
SHA256 ea92f8291b86440b98162409b1f9f04470455c22be01a1480ea5ebc37eb168dc
MD5 91046f2e147049d3e53cd9bf9d4d95ed
SHA1 228e347d062840b2edcbd16904475aacad414c62
SHA512 071a9c6e17760a726c3a4519cf8006f36f17f50946af0129e0e1f3e480f6b7fcc804a7614b044247f2420a8b2b46bec5b8493e4869bb918bc7c0f6aa1346c3e0
MD5 SHA1 SHA512

Submit Download

KNVPN_Installer (1).exe

Path C:\Users\Admin\AppData\Local\Temp\KNVPN_Installer (1).exe
Size 219KB
SHA256 026e2a8c8072c4b2a5b89e23d90d8dcdfaf0ec5ceba16af1a0e657b890635d77
MD5 b9aad99833bfb427678841e096b7deb7
SHA1 892cb39891e14ed8ae0bb79d69b82ae889b70b2b
SHA512 526e61ed0305202028b3d188f22c048f0d0d5491349761b31bb283152b9f023b22429898539e25ede128b0eb5d82ee0812dee180f84e62eb396e9a301f6cac42
SSDEEP 768:3PW2XqgG6xUDhhcC05NuBU0p5NjYReTcLF:/WLgG6xUVhAAp5uReTcLF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Users\Admin\AppData\Local\Temp\Server.exe
Size 23KB
SHA256 a90bb1ce1e0f7f73d0bee0b650a89d3afe86dce581ad064d98acd1132d78bd16
MD5 920e879a7f98eafc6361233a1185530c
SHA1 25385a7a01961afdce821ea5fce4fdb10d6a0976
SHA512 0791b22ff0babe8b97c768061d9b70b1558b51527a75309d15d8aebca311995e00a6dc9ee8d2ea40d48b2e0cacb0812e4c05daff43edb74fe7655da971cc4956
SSDEEP 384:Vzc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZwD:V5e9EJLN/yRpcnuJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-0-0x00007FF85D5F0000-0x00007FF85D8B9000-memory.dmp

Download

memory/216-1-0x000000001B800000-0x000000001B8A6000-memory.dmp

Download

memory/216-2-0x00007FF85D5F0000-0x00007FF85D8B9000-memory.dmp

Download

memory/216-3-0x000000001BD80000-0x000000001C24E000-memory.dmp

Download

memory/216-4-0x000000001C2F0000-0x000000001C38C000-memory.dmp

Download

memory/216-5-0x00000000011B0000-0x00000000011B8000-memory.dmp

Download

memory/216-6-0x000000001C450000-0x000000001C49C000-memory.dmp

Download

memory/216-29-0x00007FF85D5F0000-0x00007FF85D8B9000-memory.dmp

Download

memory/2596-30-0x0000000000460000-0x000000000049C000-memory.dmp

Download

memory/2596-27-0x00000000746DE000-0x00000000746DF000-memory.dmp

Download

memory/2596-51-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Download

memory/2596-31-0x0000000004D00000-0x0000000004D9C000-memory.dmp

Download

memory/2596-50-0x00000000746DE000-0x00000000746DF000-memory.dmp

Download

memory/2596-34-0x0000000005350000-0x00000000058F4000-memory.dmp

Download

memory/2596-35-0x0000000004E40000-0x0000000004ED2000-memory.dmp

Download

memory/2596-36-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Download

memory/2596-38-0x0000000005030000-0x0000000005086000-memory.dmp

Download

memory/2596-37-0x0000000004DB0000-0x0000000004DBA000-memory.dmp

Download

memory/5040-28-0x0000000074042000-0x0000000074043000-memory.dmp

Download

memory/5040-49-0x0000000074040000-0x00000000745F1000-memory.dmp

Download

memory/5040-33-0x0000000074040000-0x00000000745F1000-memory.dmp

Download

memory/5040-32-0x0000000074040000-0x00000000745F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads