njrat | b18cba68f67b34911aad110cb017b674f96264abbd2cb696ff49ca559f101cd0 | Triage

Sharing

General

Target

e44c426d2c3fe74ff9c10f730b212b7e_JaffaCakes118
Size

37KB
Sample

240916-jgf6vawbmf
MD5

e44c426d2c3fe74ff9c10f730b212b7e
SHA1

13f65b7251a56f4565213a3386448f1883f1a028
SHA256

b18cba68f67b34911aad110cb017b674f96264abbd2cb696ff49ca559f101cd0
SHA512

ccd2f10fbcc4a7e473f48d6abc3111759aecc816dc655c9b20e977d310580fac8e375e35d86f4ee4f7402755699acebdf03884aecbc28432fefd4c420fac9964
SSDEEP

384:QAXWoixJZl7OHg1WykrxB/dQ8+K3nlrAF+rMRTyN/0L+EcoinblneHQM3epzXIND:nX+R1NkrxBq1KXlrM+rMRa8NuWLt

Score

10^/10

njrat dimonhack discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

DIMONHACK

C2

89.148.241.97:9291

Mutex

12570e586ba38e24ce105cff1e0705ac

Attributes

reg_key
12570e586ba38e24ce105cff1e0705ac
splitter
|'|'|

Targets

- Target
  
  e44c426d2c3fe74ff9c10f730b212b7e_JaffaCakes118
- Size
  
  37KB
- MD5
  
  e44c426d2c3fe74ff9c10f730b212b7e
- SHA1
  
  13f65b7251a56f4565213a3386448f1883f1a028
- SHA256
  
  b18cba68f67b34911aad110cb017b674f96264abbd2cb696ff49ca559f101cd0
- SHA512
  
  ccd2f10fbcc4a7e473f48d6abc3111759aecc816dc655c9b20e977d310580fac8e375e35d86f4ee4f7402755699acebdf03884aecbc28432fefd4c420fac9964
- SSDEEP
  
  384:QAXWoixJZl7OHg1WykrxB/dQ8+K3nlrAF+rMRTyN/0L+EcoinblneHQM3epzXIND:nX+R1NkrxBq1KXlrM+rMRa8NuWLt
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation