njrat | 3c90f7e66714f9cf7b2912e62a5772d0b47d0548bfa92376ebc5fa08cbc21a4e

General

Target

f12d0d690b86148cce1f7d01911b5359_JaffaCakes118.exe
Size

760KB
MD5

f12d0d690b86148cce1f7d01911b5359
SHA1

34cba5dc1de74d656c2b6e52789779689ff5d967
SHA256

3c90f7e66714f9cf7b2912e62a5772d0b47d0548bfa92376ebc5fa08cbc21a4e
SHA512

95405496452b02225c2c292f53382e762adc0ea2a9cb9c07b9cd00a34d1405f27a5c3e4f928810b6b887dff71ff0a95faa09e41292078f1609dea5a9cdae1ab5
SSDEEP

12288:JcrNS33L10QdrXZT+tcWn0s6tKWOj4f1cfS4yWr9ousp1oRUr5jjo/:0NA3R5drX/W9tWqWSSSvU1oi4

Score

10^/10

njrat hacked discovery persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

2.tcp.ngrok.io:18729

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	f12d0d690b86148cce1f7d01911b5359_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Photo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Server.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Server.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.exe	svhost.exe

Executes dropped EXE 6 IoCs

pid	Process
4700	Photo.exe
3224	Server.sfx.exe
4688	Server.exe
2576	svhost.exe
4760	Server.exe
4180	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
21	2.tcp.ngrok.io
38	2.tcp.ngrok.io
59	2.tcp.ngrok.io
61	2.tcp.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f12d0d690b86148cce1f7d01911b5359_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.sfx.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4424	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4688	Server.exe
2576	svhost.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe
Token: 33	2576	svhost.exe
Token: SeIncBasePriorityPrivilege	2576	svhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4700	2924	f12d0d690b86148cce1f7d01911b5359_JaffaCakes118.exe	82
PID 2924 wrote to memory of 4700	2924	f12d0d690b86148cce1f7d01911b5359_JaffaCakes118.exe	82
PID 2924 wrote to memory of 4700	2924	f12d0d690b86148cce1f7d01911b5359_JaffaCakes118.exe	82
PID 4700 wrote to memory of 2052	4700	Photo.exe	84
PID 4700 wrote to memory of 2052	4700	Photo.exe	84
PID 4700 wrote to memory of 2052	4700	Photo.exe	84
PID 2052 wrote to memory of 3224	2052	cmd.exe	86
PID 2052 wrote to memory of 3224	2052	cmd.exe	86
PID 2052 wrote to memory of 3224	2052	cmd.exe	86
PID 3224 wrote to memory of 4688	3224	Server.sfx.exe	87
PID 3224 wrote to memory of 4688	3224	Server.sfx.exe	87
PID 4688 wrote to memory of 2576	4688	Server.exe	93
PID 4688 wrote to memory of 2576	4688	Server.exe	93
PID 2576 wrote to memory of 4424	2576	svhost.exe	96
PID 2576 wrote to memory of 4424	2576	svhost.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f12d0d690b86148cce1f7d01911b5359_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f12d0d690b86148cce1f7d01911b5359_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Photo.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Photo.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\1.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Server.sfx.exe
      Server.sfx.exe -pqazwsx123
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Server.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:4688
      - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        6⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4424

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:4760

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Server.exe.log

Filesize
1KB

MD5
a8a147915e3a996fdbe10b3a3f1e1bb2

SHA1
abc564c1be468d57e700913e7b6cf8f62d421263

SHA256
8b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e

SHA512
17b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Photo.exe

Filesize
474KB

MD5
21a94b17436a53c51b8705d0c6236720

SHA1
8fb2efe966bbb75e73b1321a0060d859e4915217

SHA256
f0ed866b66b889b68ee56274562d16d4b688608aecb05e5447ca9084a5677413

SHA512
97952c63d19378d717d2a3a67863776108d3b963673e46a65a0448c872dc781d09d9afa8e812e392f0b6a8f43615d5e57784ea57bb28e185b38ad10cd9595fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\1.bat

Filesize
43B

MD5
6866420d995e05262a2d6e02f2d9dea6

SHA1
a2ccaf31a9728d7c8307c6ee9f1727f4145d7a0b

SHA256
5a82c2b52897e92236163397494bad624d863292185fc1efb738450814bebea8

SHA512
7cdfec8d01427b3da23e6206843d54d63bba6b8027e445bc60327e57c04e20c458109bc19f7fd5d6b08ad7b26aa8ba9c562fea62910237f08fcbce589acb31d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Server.sfx.exe

Filesize
316KB

MD5
71b2beecb42585ff4eb1cc5b4dfc92a0

SHA1
2a3d0bae170df989ffa9fc7fc5589e5f659c609b

SHA256
1f33425db77d57beda8f6b7aa42960ca445d51728453450320013c47188a71d8

SHA512
94e2b8027796eb9f0cfda15968b4331f5b7069285f3680b0d14aab42fcd7971e80fcaaeff20ec0a92101439338192eb4e4b3b8496ff8825ca1e6182859496a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Server.exe

Filesize
25KB

MD5
8480b324283fc52353afb327fe10028e

SHA1
471dd43a66dbad1be2cb51502b022be6647c7f6b

SHA256
2abceec17e6367a28b201c9222b813ae053ff62605e8d8a5c9a3f96f6d5b5db5

SHA512
3cb6a445935948a8d4e47a57ba06b0ba1e74f3b0844f69ef80ebbbf127aaa5424ba0d26861a0ef681bfe019dbced842f947ae6d521e9050b619a343f17b1437e

Download Submit
memory/2576-41-0x0000000002F40000-0x0000000002F52000-memory.dmp

Filesize
72KB

Download
memory/4688-30-0x00000000008F0000-0x00000000008F8000-memory.dmp

Filesize
32KB

Download
memory/4688-31-0x0000000002940000-0x0000000002952000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads