Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    29-05-2024 10:59

General

  • Target

    8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe

  • Size

    491KB

  • MD5

    8082dc64e072c3c1c816fb10d54c5b46

  • SHA1

    6bc3ae1761044e8ebb7c036de98ca016a7371181

  • SHA256

    e5dd0b5a738b20ca30fd528b3d73561bb04c4cf1f4df523b896c3b6757c28336

  • SHA512

    d49ca18f0bab5125bffff85c43e7387f0441f59bd54a499049d34ef6e29a459dccb24d92d8ed0f60c1bfd13938a68ad41ea28b83430e2d38c0cf7ed82d072456

  • SSDEEP

    6144:JdSIHx/C9akzPAJUoofUXunIn6SY7XnETQRWaE4I8Kavb:WDraveOY7eQRWaM8dvb

Malware Config

Extracted

Family

njrat

Version

0.7 MultiHost

Botnet

nova

C2

shell.blackunix.com:1723

shell.blackunix.net:1723

nodio.blackunix.com:1723

nodio.blackunix.net:1723

kano.blackunix.com:1723

kill.blackunix.com:1723

kurtm.blackunix.com:1723

Mutex

1a9c91f6e0310d4f55b7ee7f22c2c9df

Attributes
  • reg_key

    1a9c91f6e0310d4f55b7ee7f22c2c9df

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:492
    • C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/492-0-0x0000000073FF1000-0x0000000073FF2000-memory.dmp

    Filesize

    4KB

  • memory/492-1-0x0000000073FF0000-0x000000007459B000-memory.dmp

    Filesize

    5.7MB

  • memory/492-2-0x0000000073FF0000-0x000000007459B000-memory.dmp

    Filesize

    5.7MB

  • memory/492-3-0x0000000073FF0000-0x000000007459B000-memory.dmp

    Filesize

    5.7MB

  • memory/492-4-0x0000000073FF0000-0x000000007459B000-memory.dmp

    Filesize

    5.7MB

  • memory/492-23-0x0000000073FF0000-0x000000007459B000-memory.dmp

    Filesize

    5.7MB

  • memory/2948-18-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2948-20-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2948-8-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2948-16-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2948-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2948-10-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2948-21-0x0000000073FF0000-0x000000007459B000-memory.dmp

    Filesize

    5.7MB

  • memory/2948-22-0x0000000073FF0000-0x000000007459B000-memory.dmp

    Filesize

    5.7MB

  • memory/2948-6-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2948-24-0x0000000073FF0000-0x000000007459B000-memory.dmp

    Filesize

    5.7MB