Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
28/05/2024, 19:12
General
- Target 7e121766e1e15b833eced37bd8bac0e8_JaffaCakes118.exe
- Size 43KB
- Sample240528-xwxzsshf56
- SHA256 51f4f99522b25451cdbe601649aff5137aa3c7b5fd5bccfe936a11f5f5b3f62f
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
66767
C2
-
192.168.0.18:6522
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Drops startup file 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e121766e1e15b833eced37bd8bac0e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7e121766e1e15b833eced37bd8bac0e8_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2256-0-0x00000000750EE000-0x00000000750EF000-memory.dmp
memory/2256-1-0x0000000000550000-0x0000000000562000-memory.dmp
memory/2256-2-0x0000000004ED0000-0x0000000004F6C000-memory.dmp
memory/2256-3-0x0000000005820000-0x0000000005DC4000-memory.dmp
memory/2256-4-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/2256-5-0x0000000005310000-0x00000000053A2000-memory.dmp
memory/2256-7-0x0000000005150000-0x000000000515A000-memory.dmp
memory/2256-8-0x00000000750EE000-0x00000000750EF000-memory.dmp
memory/2256-9-0x00000000750E0000-0x0000000075890000-memory.dmp