Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
21-05-2024 15:24
General
-
Target
63c74e45cb4ba38e8ba6089425a6abd8_JaffaCakes118.exe
-
Size
51KB
-
MD5
63c74e45cb4ba38e8ba6089425a6abd8
-
SHA1
62e10fad448388f8d632a92315a3f08fb4a443e4
-
SHA256
05b68547cddebd3ed640b6ad5d3bcedb6bc6f28655fc27e79a83158af135b774
-
SHA512
57a2f718aaf2e498084d1e4f889f1df3572adb1905cf2691807e954beebb5d64ea37cb6671cc2936aee9e8dd7e6c315e62e8aefa1fdad711bba5b03203843f64
-
SSDEEP
768:/EBxW6qur+oSkVuX/pvQ/kWRBBiH92xxWT52HJ4CV7I43Um:/WWYrtSfXhY/kW5iduxWT52pphI4km
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
2020
C2
monero.linkpc.net:20164
Mutex
6ec339b9056cae8141664aa65b573d66
Attributes
-
reg_key
6ec339b9056cae8141664aa65b573d66
-
splitter
XTTHX
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c74e45cb4ba38e8ba6089425a6abd8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63c74e45cb4ba38e8ba6089425a6abd8_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB