Analysis
- max time kernel
149s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
04/05/2024, 09:28
General
- Target 121aa4e293c7f9c507561af556288bb7_JaffaCakes118.exe
- Size 43KB
- Sample240504-lfpgyaaa4t
- SHA256 508ea545e1a05244df2aaafd14da1d16fa96035b82c1e532ab37b207b939e589
Malware Config
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
HacKed
-
127.0.0.1:5552
-
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 33 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\121aa4e293c7f9c507561af556288bb7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\121aa4e293c7f9c507561af556288bb7_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Dllhost.exe"C:\Users\Admin\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Dllhost.exe
memory/872-3-0x0000000005FB0000-0x0000000006554000-memory.dmp
memory/872-2-0x0000000005680000-0x000000000571C000-memory.dmp
memory/872-0-0x00000000743EE000-0x00000000743EF000-memory.dmp
memory/872-4-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/872-5-0x0000000005AA0000-0x0000000005B32000-memory.dmp
memory/872-1-0x0000000000CE0000-0x0000000000CF2000-memory.dmp
memory/872-24-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/2676-25-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/2676-26-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/2676-28-0x0000000004F50000-0x0000000004F5A000-memory.dmp
memory/2676-29-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/2676-30-0x00000000743E0000-0x0000000074B90000-memory.dmp