njrat | c988b5de0620878a133e5113ce1b64c03bae09d6099c00fb6e248473b92ef371

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00982b52825113db51775277e3d7922e_JaffaCakes118.exe
Size

408KB
MD5

00982b52825113db51775277e3d7922e
SHA1

c6761b4a32d114cc9a7a54af8c62abad6204430a
SHA256

c988b5de0620878a133e5113ce1b64c03bae09d6099c00fb6e248473b92ef371
SHA512

137b1e63029182e0391ff2cdc38f551862f94db35267178ef4c6418374af45eabde4dfb912ccc2e0dd697996b5e96cc90ed185aef44ee5368f1e200347ef49df
SSDEEP

6144:ZBGp+tWAh22uCjU4aAS8cQiqebgFq5Bs01DgeaIpGbJ9vYPCjr1kG:jCe22FjxaASjTPcLJ9vYyxk

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

213.208.152.209:5001

Mutex

a451a130b7eba7ff1ca03e6e20be0670

Attributes

reg_key
a451a130b7eba7ff1ca03e6e20be0670
splitter
|'|'|

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FolderName\\lala.exe"	reg.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2744	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lala.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lala.exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2296	winhost.exe

Loads dropped DLL 1 IoCs

pid	Process
2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
Token: 33	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
Token: SeDebugPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe
Token: 33	2296	winhost.exe
Token: SeIncBasePriorityPrivilege	2296	winhost.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2068	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2068	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2068	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2068	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32
PID 2524 wrote to memory of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32
PID 2524 wrote to memory of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32
PID 2524 wrote to memory of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32
PID 2524 wrote to memory of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32
PID 2524 wrote to memory of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32
PID 2524 wrote to memory of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32
PID 2524 wrote to memory of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32
PID 2524 wrote to memory of 2296	2524	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2276	2068	cmd.exe	33
PID 2068 wrote to memory of 2276	2068	cmd.exe	33
PID 2068 wrote to memory of 2276	2068	cmd.exe	33
PID 2068 wrote to memory of 2276	2068	cmd.exe	33
PID 2276 wrote to memory of 2796	2276	wscript.exe	34
PID 2276 wrote to memory of 2796	2276	wscript.exe	34
PID 2276 wrote to memory of 2796	2276	wscript.exe	34
PID 2276 wrote to memory of 2796	2276	wscript.exe	34
PID 2796 wrote to memory of 2680	2796	cmd.exe	36
PID 2796 wrote to memory of 2680	2796	cmd.exe	36
PID 2796 wrote to memory of 2680	2796	cmd.exe	36
PID 2796 wrote to memory of 2680	2796	cmd.exe	36
PID 2296 wrote to memory of 2744	2296	winhost.exe	38
PID 2296 wrote to memory of 2744	2296	winhost.exe	38
PID 2296 wrote to memory of 2744	2296	winhost.exe	38
PID 2296 wrote to memory of 2744	2296	winhost.exe	38

C:\Users\Admin\AppData\Local\Temp\00982b52825113db51775277e3d7922e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00982b52825113db51775277e3d7922e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\winhostf\winhost1.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\winhostf\winhostvbs.vbs" "C:\Users\Admin\AppData\Local\Temp\winhostf\winhost2.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\winhostf\winhost2.bat" "
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderName\lala.exe" /f
        5⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:2680
- C:\Users\Admin\AppData\Local\Temp\winhost.exe
  C:\Users\Admin\AppData\Local\Temp\winhost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\winhost.exe" "winhost.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winhostf\winhost1.bat

Filesize
75B

MD5
b2a7d63bc47f686e7df8c52200763891

SHA1
a9e6b1abbece47994a68221b3570987c5fa7954b

SHA256
b63308b37e470e32ba4dbc7bfb33051ec973abb4e0daf9ccbd2052a544c09f37

SHA512
773eb61f376162ae44aeb1c61e416ab9f2c622d0bbb6a129d336105149c58444cd43e8703ca0bc8eb246f8c81b4d9432594afbac6adcdf8c77276fe0263e5d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\winhostf\winhost2.bat

Filesize
404B

MD5
3c1dd4e0dc417eeb3af5504b365382ea

SHA1
52e1881ba5be8dbf8d5d46c6f50e0244cce96981

SHA256
132fa95660375d8cac3b2c7abdf0ffe35c453edc22319b1e2b3a0e9c45eed3e1

SHA512
5e5bb226ad3e98945c317dc564e6ebd67a535c7d566bfd5ab78f1d3e50f211a08216c19e0f8777253e3d4b4662c6bd29931e775e13d3245d06c981d51ce4c75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\winhostf\winhostvbs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
\Users\Admin\AppData\Local\Temp\winhost.exe

Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
memory/2296-18-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2296-31-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download
memory/2296-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2296-19-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2296-38-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download
memory/2296-17-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2296-16-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2296-26-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2296-28-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2296-23-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2524-2-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download
memory/2524-1-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download
memory/2524-37-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download
memory/2524-0-0x0000000074B41000-0x0000000074B42000-memory.dmp

Filesize
4KB

Download