njrat | c9477ac1270aa465fe2e3d461196cd88f31639f7f40fe903d53a7e70dbe0b84f

General

Target

deb1a901cfc6a298951779872072c607_JaffaCakes118.exe
Size

3.2MB
MD5

deb1a901cfc6a298951779872072c607
SHA1

37107c7711d81407344870494d60330453b46eba
SHA256

c9477ac1270aa465fe2e3d461196cd88f31639f7f40fe903d53a7e70dbe0b84f
SHA512

6342d7f5c76917bf6e3cb00928e97d33ac703a0f525589c810a40116f8de3abb738dfee67669e0ea72e5a15bbd7bdcf324628cc9345a1e8bcd559684362badf0
SSDEEP

98304:gviz/27qWGq/TzuqCDl2Ptao7jlEh5cNE:gviq75/TzufwEkNE

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2936	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
2544	CDS.exe
1204	crypted.exe
2672	svchost.exe

Loads dropped DLL 9 IoCs

pid	Process
2568	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe
2544	CDS.exe
2544	CDS.exe
2544	CDS.exe
2544	CDS.exe
2544	CDS.exe
2544	CDS.exe
2544	CDS.exe
1204	crypted.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\f1c75f8429aeb7a094280d7254438080 = "\"C:\\Windows\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f1c75f8429aeb7a094280d7254438080 = "\"C:\\Windows\\svchost.exe\" .."	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	crypted.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2544	CDS.exe
2544	CDS.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe
Token: 33	2672	svchost.exe
Token: SeIncBasePriorityPrivilege	2672	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2544	CDS.exe
2544	CDS.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2544	2568	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2544	2568	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2544	2568	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2544	2568	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2544	2568	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2544	2568	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2544	2568	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	30
PID 2544 wrote to memory of 1204	2544	CDS.exe	31
PID 2544 wrote to memory of 1204	2544	CDS.exe	31
PID 2544 wrote to memory of 1204	2544	CDS.exe	31
PID 2544 wrote to memory of 1204	2544	CDS.exe	31
PID 2544 wrote to memory of 1204	2544	CDS.exe	31
PID 2544 wrote to memory of 1204	2544	CDS.exe	31
PID 2544 wrote to memory of 1204	2544	CDS.exe	31
PID 1204 wrote to memory of 2672	1204	crypted.exe	34
PID 1204 wrote to memory of 2672	1204	crypted.exe	34
PID 1204 wrote to memory of 2672	1204	crypted.exe	34
PID 1204 wrote to memory of 2672	1204	crypted.exe	34
PID 1204 wrote to memory of 2672	1204	crypted.exe	34
PID 1204 wrote to memory of 2672	1204	crypted.exe	34
PID 1204 wrote to memory of 2672	1204	crypted.exe	34
PID 2672 wrote to memory of 2936	2672	svchost.exe	36
PID 2672 wrote to memory of 2936	2672	svchost.exe	36
PID 2672 wrote to memory of 2936	2672	svchost.exe	36
PID 2672 wrote to memory of 2936	2672	svchost.exe	36

C:\Users\Admin\AppData\Local\Temp\deb1a901cfc6a298951779872072c607_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\deb1a901cfc6a298951779872072c607_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\svchost.exe
      "C:\Windows\svchost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\svchost.exe" "svchost.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.png

Filesize
2KB

MD5
340b294efc691d1b20c64175d565ebc7

SHA1
81cb9649bd1c9a62ae79e781818fc24d15c29ce7

SHA256
72566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9

SHA512
1395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cdd

Filesize
13KB

MD5
3e7ecaeb51c2812d13b07ec852d74aaf

SHA1
e9bdab93596ffb0f7f8c65243c579180939acb26

SHA256
e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96

SHA512
635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.dat

Filesize
37KB

MD5
032444e7f2cba804b9593e6458334827

SHA1
8e91b3ded313f4d509a1f8747f90012b5e417b6b

SHA256
2cad334e60a2219aeb73d619f3347a8390f009887957e6c060366b3691642f5e

SHA512
94a6c4801a00b90c56b39fd6e018276450cf9d4693face2013fe30841d380b707946fb0388e4420ef9dd380de8d182b9337eeb19fce46e5f0b46ff4f2ccf7cf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settings

Filesize
4B

MD5
b326b5062b2f0e69046810717534cb09

SHA1
5ffe533b830f08a0326348a9160afafc8ada44db

SHA256
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

SHA512
9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll

Filesize
322KB

MD5
c3256800dce47c14acc83ccca4c3e2ac

SHA1
9d126818c66991dbc3813a65eddb88bbcf77f30a

SHA256
f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866

SHA512
6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe

Filesize
6.1MB

MD5
424bf196deaeb4ddcafb78e137fa560a

SHA1
007738e9486c904a3115daa6e8ba2ee692af58c8

SHA256
0963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2

SHA512
a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe

Filesize
37KB

MD5
5b6185aae3b882b809879e9c26792f33

SHA1
d121dcea87c6a0ded14867a4017209ce65b7a54c

SHA256
c1c524dc87d7028eb0b54049e8bcadb3cc55697dec2491fb0cb517fcde1c8c36

SHA512
087e71e610122a1531c44c9c81aaa6daee3c46d8ffb8f6ff9a201d72d0d684ccbf5362c14e4d37eb1be82e85f7b6a94c6cfc7113f31a4a8dbbb0c7b7bc2ed37f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads