njrat | b2b1e60dfac1e1ac83daed0a84d0f242f0544de79fe7beaa8249e4e8f4a59632

General

Target

JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
Size

598KB
MD5

6c5aa6123e51241bb10572f8d1c97fa0
SHA1

1c9e42c66f683b10621a8656d3f8cfe4192041c7
SHA256

b2b1e60dfac1e1ac83daed0a84d0f242f0544de79fe7beaa8249e4e8f4a59632
SHA512

ac3d2e72691d314c8546e3dc33b3a2bb1ed63c60631150d665b666a7812d83f8cbfb02b7c18a4b9042b48012ec4f36c40d40fe3c199a1c10300e8afb66bed893
SSDEEP

12288:kS9PV4BzYtXkjJo1fLJNTsJQqY/v8tL/me7ZljHJ0PU0SyNq26uMMGds20eIS7BT:kS9PV4BzYtXkjJo1fLJNTsJQqY/v8tLH

Score

10^/10

njrat خاروف discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

خاروف

C2

medo-m919.no-ip.biz:1177

Mutex

dee4de9286cf6ca55b97bc4f481b14d6

Attributes

reg_key
dee4de9286cf6ca55b97bc4f481b14d6
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4992	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe

Executes dropped EXE 2 IoCs

pid	Process
3744	medo.exe
2248	medo.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dee4de9286cf6ca55b97bc4f481b14d6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\medo.exe\" .."	medo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dee4de9286cf6ca55b97bc4f481b14d6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\medo.exe\" .."	medo.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3332 set thread context of 4344	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe	82
PID 3744 set thread context of 2248	3744	medo.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	medo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	medo.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
3744	medo.exe
3744	medo.exe
3744	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe
2248	medo.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
Token: 33	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
Token: SeIncBasePriorityPrivilege	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
Token: SeDebugPrivilege	4344	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
Token: 33	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
Token: SeIncBasePriorityPrivilege	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
Token: SeDebugPrivilege	3744	medo.exe
Token: 33	3744	medo.exe
Token: SeIncBasePriorityPrivilege	3744	medo.exe
Token: SeDebugPrivilege	2248	medo.exe
Token: 33	3744	medo.exe
Token: SeIncBasePriorityPrivilege	3744	medo.exe
Token: 33	3744	medo.exe
Token: SeIncBasePriorityPrivilege	3744	medo.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4344	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe	82
PID 3332 wrote to memory of 4344	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe	82
PID 3332 wrote to memory of 4344	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe	82
PID 3332 wrote to memory of 4344	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe	82
PID 3332 wrote to memory of 4344	3332	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe	82
PID 4344 wrote to memory of 3744	4344	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe	83
PID 4344 wrote to memory of 3744	4344	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe	83
PID 4344 wrote to memory of 3744	4344	JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe	83
PID 3744 wrote to memory of 2248	3744	medo.exe	84
PID 3744 wrote to memory of 2248	3744	medo.exe	84
PID 3744 wrote to memory of 2248	3744	medo.exe	84
PID 3744 wrote to memory of 2248	3744	medo.exe	84
PID 3744 wrote to memory of 2248	3744	medo.exe	84
PID 2248 wrote to memory of 4992	2248	medo.exe	86
PID 2248 wrote to memory of 4992	2248	medo.exe	86
PID 2248 wrote to memory of 4992	2248	medo.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Users\Admin\AppData\Roaming\medo.exe
    "C:\Users\Admin\AppData\Roaming\medo.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Users\Admin\AppData\Roaming\medo.exe
      C:\Users\Admin\AppData\Roaming\medo.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\medo.exe" "medo.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JaffaCakes118_6c5aa6123e51241bb10572f8d1c97fa0.exe.log

Filesize
617B

MD5
85306571e7ae6002dd2a0fb3042b7472

SHA1
c897ab7434b118a8ec1fe25205903f5ec8f71241

SHA256
40c98b01052cd95102701b71b4fbe0eda48537435898c413239f5f888a614253

SHA512
0e9853dab46fd5f6f9eea44377d3802e9cc2fff7ba2f9b45c7c8fc37b860ad9c3c4beb6e1572c87964e06144504210e29038cb03e00c7e7af6ad32e6e995c76a

Download Submit
C:\Users\Admin\AppData\Roaming\medo.exe

Filesize
598KB

MD5
6c5aa6123e51241bb10572f8d1c97fa0

SHA1
1c9e42c66f683b10621a8656d3f8cfe4192041c7

SHA256
b2b1e60dfac1e1ac83daed0a84d0f242f0544de79fe7beaa8249e4e8f4a59632

SHA512
ac3d2e72691d314c8546e3dc33b3a2bb1ed63c60631150d665b666a7812d83f8cbfb02b7c18a4b9042b48012ec4f36c40d40fe3c199a1c10300e8afb66bed893

Download Submit
memory/3332-26-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3332-59-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3332-4-0x0000000004C70000-0x0000000004D02000-memory.dmp

Filesize
584KB

Download
memory/3332-5-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3332-6-0x0000000004BA0000-0x0000000004BAA000-memory.dmp

Filesize
40KB

Download
memory/3332-7-0x0000000002420000-0x000000000242A000-memory.dmp

Filesize
40KB

Download
memory/3332-10-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3332-0-0x000000007519E000-0x000000007519F000-memory.dmp

Filesize
4KB

Download
memory/3332-22-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3332-1-0x00000000000C0000-0x000000000015C000-memory.dmp

Filesize
624KB

Download
memory/3332-3-0x0000000005180000-0x0000000005724000-memory.dmp

Filesize
5.6MB

Download
memory/3332-57-0x00000000061F0000-0x0000000006208000-memory.dmp

Filesize
96KB

Download
memory/3332-23-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3332-2-0x0000000004AC0000-0x0000000004B5C000-memory.dmp

Filesize
624KB

Download
memory/3744-41-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3744-42-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3744-61-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/4344-40-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/4344-38-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/4344-25-0x0000000003280000-0x000000000328E000-memory.dmp

Filesize
56KB

Download
memory/4344-24-0x0000000001930000-0x000000000193E000-memory.dmp

Filesize
56KB

Download
memory/4344-20-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads