Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
27/04/2024, 01:52
General
- Target 022546fb9a9b62958ddb0794c9f6b95a_JaffaCakes118.exe
- Size 43KB
- Sample240427-cafheagf57
- SHA256 3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587
Malware Config
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
HacKed
-
nikits.ddns.net:1604
-
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\022546fb9a9b62958ddb0794c9f6b95a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\022546fb9a9b62958ddb0794c9f6b95a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Dllhost.exe
memory/3932-17-0x0000000002530000-0x0000000002540000-memory.dmp
memory/3932-16-0x00000000747E0000-0x0000000074F90000-memory.dmp
memory/3932-19-0x0000000004C90000-0x0000000004C9A000-memory.dmp
memory/3932-20-0x00000000747E0000-0x0000000074F90000-memory.dmp
memory/3932-21-0x0000000002530000-0x0000000002540000-memory.dmp
memory/4868-2-0x00000000747E0000-0x0000000074F90000-memory.dmp
memory/4868-4-0x00000000057C0000-0x0000000005D64000-memory.dmp
memory/4868-3-0x0000000005100000-0x0000000005110000-memory.dmp
memory/4868-5-0x00000000052F0000-0x0000000005382000-memory.dmp
memory/4868-1-0x0000000004ED0000-0x0000000004F6C000-memory.dmp
memory/4868-15-0x00000000747E0000-0x0000000074F90000-memory.dmp
memory/4868-0-0x0000000000540000-0x0000000000552000-memory.dmp