njrat | c9477ac1270aa465fe2e3d461196cd88f31639f7f40fe903d53a7e70dbe0b84f

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deb1a901cfc6a298951779872072c607_JaffaCakes118.exe
Size

3.2MB
MD5

deb1a901cfc6a298951779872072c607
SHA1

37107c7711d81407344870494d60330453b46eba
SHA256

c9477ac1270aa465fe2e3d461196cd88f31639f7f40fe903d53a7e70dbe0b84f
SHA512

6342d7f5c76917bf6e3cb00928e97d33ac703a0f525589c810a40116f8de3abb738dfee67669e0ea72e5a15bbd7bdcf324628cc9345a1e8bcd559684362badf0
SSDEEP

98304:gviz/27qWGq/TzuqCDl2Ptao7jlEh5cNE:gviq75/TzufwEkNE

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
624	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	CDS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	crypted.exe

Executes dropped EXE 3 IoCs

pid	Process
1588	CDS.exe
3104	crypted.exe
4236	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1588	CDS.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1c75f8429aeb7a094280d7254438080 = "\"C:\\Windows\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\f1c75f8429aeb7a094280d7254438080 = "\"C:\\Windows\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	crypted.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1588	CDS.exe
1588	CDS.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: 33	3132	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3132	AUDIODG.EXE
Token: SeDebugPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe
Token: 33	4236	svchost.exe
Token: SeIncBasePriorityPrivilege	4236	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1588	CDS.exe
1588	CDS.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1588	2580	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	84
PID 2580 wrote to memory of 1588	2580	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	84
PID 2580 wrote to memory of 1588	2580	deb1a901cfc6a298951779872072c607_JaffaCakes118.exe	84
PID 1588 wrote to memory of 3104	1588	CDS.exe	88
PID 1588 wrote to memory of 3104	1588	CDS.exe	88
PID 1588 wrote to memory of 3104	1588	CDS.exe	88
PID 3104 wrote to memory of 4236	3104	crypted.exe	96
PID 3104 wrote to memory of 4236	3104	crypted.exe	96
PID 3104 wrote to memory of 4236	3104	crypted.exe	96
PID 4236 wrote to memory of 624	4236	svchost.exe	100
PID 4236 wrote to memory of 624	4236	svchost.exe	100
PID 4236 wrote to memory of 624	4236	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\deb1a901cfc6a298951779872072c607_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\deb1a901cfc6a298951779872072c607_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\svchost.exe
      "C:\Windows\svchost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\svchost.exe" "svchost.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:624

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.png

Filesize
2KB

MD5
340b294efc691d1b20c64175d565ebc7

SHA1
81cb9649bd1c9a62ae79e781818fc24d15c29ce7

SHA256
72566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9

SHA512
1395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cdd

Filesize
13KB

MD5
3e7ecaeb51c2812d13b07ec852d74aaf

SHA1
e9bdab93596ffb0f7f8c65243c579180939acb26

SHA256
e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96

SHA512
635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe

Filesize
6.1MB

MD5
424bf196deaeb4ddcafb78e137fa560a

SHA1
007738e9486c904a3115daa6e8ba2ee692af58c8

SHA256
0963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2

SHA512
a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.dat

Filesize
37KB

MD5
032444e7f2cba804b9593e6458334827

SHA1
8e91b3ded313f4d509a1f8747f90012b5e417b6b

SHA256
2cad334e60a2219aeb73d619f3347a8390f009887957e6c060366b3691642f5e

SHA512
94a6c4801a00b90c56b39fd6e018276450cf9d4693face2013fe30841d380b707946fb0388e4420ef9dd380de8d182b9337eeb19fce46e5f0b46ff4f2ccf7cf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe

Filesize
37KB

MD5
5b6185aae3b882b809879e9c26792f33

SHA1
d121dcea87c6a0ded14867a4017209ce65b7a54c

SHA256
c1c524dc87d7028eb0b54049e8bcadb3cc55697dec2491fb0cb517fcde1c8c36

SHA512
087e71e610122a1531c44c9c81aaa6daee3c46d8ffb8f6ff9a201d72d0d684ccbf5362c14e4d37eb1be82e85f7b6a94c6cfc7113f31a4a8dbbb0c7b7bc2ed37f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settings

Filesize
4B

MD5
b326b5062b2f0e69046810717534cb09

SHA1
5ffe533b830f08a0326348a9160afafc8ada44db

SHA256
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

SHA512
9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll

Filesize
322KB

MD5
c3256800dce47c14acc83ccca4c3e2ac

SHA1
9d126818c66991dbc3813a65eddb88bbcf77f30a

SHA256
f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866

SHA512
6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25

Download Submit