njrat | 71a60a3a3c02e228da746c4ca56cb05e7fc547ae257aee65cb8c37fc7c8b1be8

General

Target

e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Size

124KB
MD5

e842a8a3c48560b118ad2fdcab6b01aa
SHA1

1ae744306e0ca219d5d3a71b7b3c561556bb06bb
SHA256

71a60a3a3c02e228da746c4ca56cb05e7fc547ae257aee65cb8c37fc7c8b1be8
SHA512

b2fa5a0818247c03620b24298785298f224ac752e134a72c6da256b23497c8748d10fabd87e6647715e9069bc55eb046a6c835ea4551e42edf3818fe148d1db7
SSDEEP

1536:vdw+IkzrUErhvozUQzHpxZvbS3gTotapQAVwq86XiMPZw/a7KVrlee:vdwunv1oz1xRbSQToEp3w04aK0e

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:789

Mutex

018af7de9673644d23451473d09bedbd

Attributes

reg_key
018af7de9673644d23451473d09bedbd
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3992	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: 33	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: 33	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: 33	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: 33	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: 33	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: 33	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: 33	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: 33	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: 33	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3992	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe	78
PID 1956 wrote to memory of 3992	1956	e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe	78

C:\Users\Admin\AppData\Local\Temp\e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SYSTEM32\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe" "e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3680

C:\Users\Admin\AppData\Local\Temp\e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e842a8a3c48560b118ad2fdcab6b01aa_JaffaCakes118.exe"
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-0-0x00007FFACD705000-0x00007FFACD706000-memory.dmp

Filesize
4KB

Download
memory/1956-1-0x000000001B540000-0x000000001B5E6000-memory.dmp

Filesize
664KB

Download
memory/1956-2-0x00007FFACD450000-0x00007FFACDDF1000-memory.dmp

Filesize
9.6MB

Download
memory/1956-3-0x000000001BAC0000-0x000000001BF8E000-memory.dmp

Filesize
4.8MB

Download
memory/1956-4-0x000000001C030000-0x000000001C0CC000-memory.dmp

Filesize
624KB

Download
memory/1956-5-0x00007FFACD450000-0x00007FFACDDF1000-memory.dmp

Filesize
9.6MB

Download
memory/1956-6-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Filesize
32KB

Download
memory/1956-7-0x000000001C260000-0x000000001C2AC000-memory.dmp

Filesize
304KB

Download
memory/1956-8-0x00007FFACD450000-0x00007FFACDDF1000-memory.dmp

Filesize
9.6MB

Download
memory/1956-9-0x00007FFACD450000-0x00007FFACDDF1000-memory.dmp

Filesize
9.6MB

Download
memory/1956-10-0x0000000000F00000-0x0000000000F0C000-memory.dmp

Filesize
48KB

Download
memory/1956-11-0x00007FFACD705000-0x00007FFACD706000-memory.dmp

Filesize
4KB

Download
memory/1956-12-0x00007FFACD450000-0x00007FFACDDF1000-memory.dmp

Filesize
9.6MB

Download
memory/1956-13-0x00007FFACD450000-0x00007FFACDDF1000-memory.dmp

Filesize
9.6MB

Download
memory/1956-14-0x00007FFACD450000-0x00007FFACDDF1000-memory.dmp

Filesize
9.6MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads