njrat | 2cfa5cd046adf57d926061b64dca6d8ba637885ea0a5e0aec11f0b01e8d3153e

General

Target

8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Size

405KB
MD5

8b653439517f58d135180ab16effe955
SHA1

86772f7366a2c7fdcd0daea423fd70121710900a
SHA256

2cfa5cd046adf57d926061b64dca6d8ba637885ea0a5e0aec11f0b01e8d3153e
SHA512

9c5f054c0af242668197139dd53e64bf23d6285d8ed746a8c5d87a72e3557452b0850fb726a99f3bafe44ac8b93160081a480535c39c63e8a0bd4225319be2f7
SSDEEP

3072:yOVTH9dqOVTH9dphiegXp57ewCmFDoBqMvJDA5ZUEb6Evwoe+wiM1uw+TtWn7fJ+:F95D81ew5V5ZH6Evwoe+wiM1uwIx1f

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

7b1cba4c2fd49c8ec47f2b8a10ea378a

Attributes

reg_key
7b1cba4c2fd49c8ec47f2b8a10ea378a
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2676 netsh.exe

pid	process
2676	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

8b653439517f58d135180ab16effe955_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: 33	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8b653439517f58d135180ab16effe955_JaffaCakes118.exe

description	pid	process	target process
PID 2924 wrote to memory of 2676	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe	netsh.exe
PID 2924 wrote to memory of 2676	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe	netsh.exe
PID 2924 wrote to memory of 2676	2924	8b653439517f58d135180ab16effe955_JaffaCakes118.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\8b653439517f58d135180ab16effe955_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8b653439517f58d135180ab16effe955_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\8b653439517f58d135180ab16effe955_JaffaCakes118.exe" "8b653439517f58d135180ab16effe955_JaffaCakes118.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2924-2-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/2924-1-0x0000000000810000-0x000000000087C000-memory.dmp

Filesize
432KB

Download
memory/2924-0-0x000007FEF6163000-0x000007FEF6164000-memory.dmp

Filesize
4KB

Download
memory/2924-3-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download
memory/2924-4-0x000007FEF6163000-0x000007FEF6164000-memory.dmp

Filesize
4KB

Download
memory/2924-5-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads