njrat | c098756128e63736c0afe05607b4bcf08b550aa26b6200f9cd29729136c5ec4c

General

Target

e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Size

153KB
MD5

e3660d1c128b1d65b91bd03fdeb65ac9
SHA1

27cf3b67238cc1cd30c276e52edbdf407eaf6427
SHA256

c098756128e63736c0afe05607b4bcf08b550aa26b6200f9cd29729136c5ec4c
SHA512

8cfc502ba8858265e2339a59edd00a8794899f380c132b7b26366b30e4878d440d785b4cf6dda36737ab1978ee38913d531c224be0bc623bf7719391cd634a72
SSDEEP

3072:nqjtlbsvvzDl8LW6l7/wP+9O4OzmNGYdVgFXrPn3eFUSG1fYBVjL:qwSK6lBO4OeUh8zG1fY3H

Score

10^/10

njrat ftd discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

FTD

C2

amon008.duckdns.org:1006

Mutex

6c1567cde2639e7f2e31584fc3be4bb7

Attributes

reg_key
6c1567cde2639e7f2e31584fc3be4bb7
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2820	netsh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 2256	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	32

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: 33	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 592	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	31
PID 1792 wrote to memory of 592	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	31
PID 1792 wrote to memory of 592	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	31
PID 1792 wrote to memory of 592	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	31
PID 1792 wrote to memory of 2256	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	32
PID 1792 wrote to memory of 2256	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	32
PID 1792 wrote to memory of 2256	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	32
PID 1792 wrote to memory of 2256	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	32
PID 1792 wrote to memory of 2256	1792	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	32
PID 2256 wrote to memory of 2820	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2820	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2820	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2820	2256	e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe"
  2⤵
  PID:592
- C:\Users\Admin\AppData\Local\Temp\e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe" "e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-10-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/1792-1-0x0000000001330000-0x000000000135A000-memory.dmp

Filesize
168KB

Download
memory/1792-2-0x0000000000460000-0x000000000047A000-memory.dmp

Filesize
104KB

Download
memory/1792-3-0x0000000000480000-0x0000000000492000-memory.dmp

Filesize
72KB

Download
memory/1792-4-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/1792-5-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/1792-6-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/1792-9-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/1792-0-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/2256-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2256-12-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2256-15-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2256-16-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2256-17-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2256-18-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2256-19-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads