njrat | 850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87

General

Target

bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe
Size

37KB
MD5

bb9d4ebcc754a7e6cb7536b735d85fdf
SHA1

62a93b979c2634af2b39520df73249747bbed84c
SHA256

850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87
SHA512

e727a8e987da902339c6ceef93e163fedaa8a0a03c5e0784ac919653f0428f8723ebab7d232cef80bd1337956254c4333fba500ee85fdfdc2a80884822e48363
SSDEEP

384:gUG23hUidkGXR21cGMy8Pqq53tGFlymZErAF+rMRTyN/0L+EcoinblneHQM3epzs:JG23ZLGv8Pqq58im+rM+rMRa8NuFgt

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

miop.ddns.net:2280

Mutex

18df5afc301de09badbb5fa494c2daf3

Attributes

reg_key
18df5afc301de09badbb5fa494c2daf3
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2484 netsh.exe

pid	process
2484	netsh.exe

Drops startup file 2 IoCs

Processes:

server5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18df5afc301de09badbb5fa494c2daf3.exe	server5.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18df5afc301de09badbb5fa494c2daf3.exe	server5.exe

Executes dropped EXE 1 IoCs

Processes:

server5.exe

pid process

2616 server5.exe
Loads dropped DLL 1 IoCs

Processes:

bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe

pid process

1924 bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2616	server5.exe

pid	process
1924	bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

server5.exe

description	pid	process
Token: SeDebugPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe
Token: 33	2616	server5.exe
Token: SeIncBasePriorityPrivilege	2616	server5.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exeserver5.exe

description	pid	process	target process
PID 1924 wrote to memory of 2616	1924	bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe	server5.exe
PID 1924 wrote to memory of 2616	1924	bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe	server5.exe
PID 1924 wrote to memory of 2616	1924	bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe	server5.exe
PID 1924 wrote to memory of 2616	1924	bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe	server5.exe
PID 2616 wrote to memory of 2484	2616	server5.exe	netsh.exe
PID 2616 wrote to memory of 2484	2616	server5.exe	netsh.exe
PID 2616 wrote to memory of 2484	2616	server5.exe	netsh.exe
PID 2616 wrote to memory of 2484	2616	server5.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb9d4ebcc754a7e6cb7536b735d85fdf_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Local\Temp\server5.exe
"C:\Users\Admin\AppData\Local\Temp\server5.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server5.exe" "server5.exe" ENABLE
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2484

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server5.exe
Filesize
37KB

MD5
bb9d4ebcc754a7e6cb7536b735d85fdf

SHA1
62a93b979c2634af2b39520df73249747bbed84c

SHA256
850072b510695bd8649daad557e371b869054361e888d1aa4ffa51cf8e8c7c87

SHA512
e727a8e987da902339c6ceef93e163fedaa8a0a03c5e0784ac919653f0428f8723ebab7d232cef80bd1337956254c4333fba500ee85fdfdc2a80884822e48363

Download Submit
memory/1924-0-0x00000000741B1000-0x00000000741B2000-memory.dmp

Filesize
4KB

Download
memory/1924-1-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-2-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-10-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2616-13-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2616-12-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2616-11-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2616-15-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads