njrat | ce05dd9173db5ba7f49608f29bf54db690682dad115926b8691217f769383179

General

Target

e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe
Size

1.3MB
MD5

e6a0c30f0cea84220963e798d1ea1533
SHA1

5bc11adf33fc0591af8eb34189667a445c375003
SHA256

ce05dd9173db5ba7f49608f29bf54db690682dad115926b8691217f769383179
SHA512

558bb175fe5753f8e9da59d526cd7cadf99e98f614ba6160ab8e5603b3c08d11040552ab017c3c6ad67b4cde7a3eabcf39142f11a6f2a64e7e15b3ebdb2450fe
SSDEEP

3072:qNNwCmByk4u5v5c1smXz7eU6IzI19paRVE/KzoTQ2X:qCBykAxX2U6l4RVkQ2X

Score

10^/10

njrat تم الاختراق من قبل دكتور الغربية #discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

تم الاختراق من قبل دكتور الغربية #

C2

Dr187.ddns.net:999

Mutex

59e66e4fd01ed7a53bb65713760bdb7d

Attributes

reg_key
59e66e4fd01ed7a53bb65713760bdb7d
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3616	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59e66e4fd01ed7a53bb65713760bdb7d.exe	Google Root.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59e66e4fd01ed7a53bb65713760bdb7d.exe	Google Root.exe

Executes dropped EXE 2 IoCs

pid	Process
2096	Google Root.exe
3272	Google Root.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\59e66e4fd01ed7a53bb65713760bdb7d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Root.exe\" .."	Google Root.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\59e66e4fd01ed7a53bb65713760bdb7d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Root.exe\" .."	Google Root.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2928 set thread context of 2736	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	82
PID 2096 set thread context of 3272	2096	Google Root.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Google Root.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Google Root.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe
3272	Google Root.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe
Token: SeDebugPrivilege	2096	Google Root.exe
Token: SeDebugPrivilege	3272	Google Root.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2736	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	82
PID 2928 wrote to memory of 2736	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	82
PID 2928 wrote to memory of 2736	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	82
PID 2928 wrote to memory of 2736	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	82
PID 2928 wrote to memory of 2736	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	82
PID 2928 wrote to memory of 2736	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	82
PID 2928 wrote to memory of 2736	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	82
PID 2928 wrote to memory of 2736	2928	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	82
PID 2736 wrote to memory of 2096	2736	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	83
PID 2736 wrote to memory of 2096	2736	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	83
PID 2736 wrote to memory of 2096	2736	e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe	83
PID 2096 wrote to memory of 3272	2096	Google Root.exe	84
PID 2096 wrote to memory of 3272	2096	Google Root.exe	84
PID 2096 wrote to memory of 3272	2096	Google Root.exe	84
PID 2096 wrote to memory of 3272	2096	Google Root.exe	84
PID 2096 wrote to memory of 3272	2096	Google Root.exe	84
PID 2096 wrote to memory of 3272	2096	Google Root.exe	84
PID 2096 wrote to memory of 3272	2096	Google Root.exe	84
PID 2096 wrote to memory of 3272	2096	Google Root.exe	84
PID 3272 wrote to memory of 3616	3272	Google Root.exe	85
PID 3272 wrote to memory of 3616	3272	Google Root.exe	85
PID 3272 wrote to memory of 3616	3272	Google Root.exe	85

C:\Users\Admin\AppData\Local\Temp\e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Google Root.exe
    "C:\Users\Admin\AppData\Local\Temp\Google Root.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Google Root.exe
      "C:\Users\Admin\AppData\Local\Temp\Google Root.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3272
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Google Root.exe" "Google Root.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Google Root.exe.log

Filesize
499B

MD5
17f7e5c69c4f1dc984a9810dde3b6982

SHA1
601b5cf990955dabd1693049c2ed13b9ee2d2bd9

SHA256
88f6579fa5ec5ee4040bc0cc74ff0f95966ccfb0181342f51362c42cc10cee12

SHA512
a48162a368d358fe99876d95f0389f07bcbe0f689b741db722d284dbb43dfdeccb0589cc64cb0bad379333bcdbb88c0d3fba7d419572216a219907e2cf501df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\e6a0c30f0cea84220963e798d1ea1533_JaffaCakes118.exe.log

Filesize
319B

MD5
da4fafeffe21b7cb3a8c170ca7911976

SHA1
50ef77e2451ab60f93f4db88325b897d215be5ad

SHA256
7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7

SHA512
0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Google Root.exe

Filesize
1.3MB

MD5
e6a0c30f0cea84220963e798d1ea1533

SHA1
5bc11adf33fc0591af8eb34189667a445c375003

SHA256
ce05dd9173db5ba7f49608f29bf54db690682dad115926b8691217f769383179

SHA512
558bb175fe5753f8e9da59d526cd7cadf99e98f614ba6160ab8e5603b3c08d11040552ab017c3c6ad67b4cde7a3eabcf39142f11a6f2a64e7e15b3ebdb2450fe

Download Submit
memory/2096-27-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2096-22-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2096-21-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2736-20-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2736-7-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2736-3-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2736-8-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2928-2-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2928-0-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/2928-6-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/3272-28-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/3272-29-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/3272-31-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads