Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2024 10:59

General

  • Target

    8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe

  • Size

    491KB

  • MD5

    8082dc64e072c3c1c816fb10d54c5b46

  • SHA1

    6bc3ae1761044e8ebb7c036de98ca016a7371181

  • SHA256

    e5dd0b5a738b20ca30fd528b3d73561bb04c4cf1f4df523b896c3b6757c28336

  • SHA512

    d49ca18f0bab5125bffff85c43e7387f0441f59bd54a499049d34ef6e29a459dccb24d92d8ed0f60c1bfd13938a68ad41ea28b83430e2d38c0cf7ed82d072456

  • SSDEEP

    6144:JdSIHx/C9akzPAJUoofUXunIn6SY7XnETQRWaE4I8Kavb:WDraveOY7eQRWaM8dvb

Malware Config

Extracted

Family

njrat

Version

0.7 MultiHost

Botnet

nova

C2

shell.blackunix.com:1723

shell.blackunix.net:1723

nodio.blackunix.com:1723

nodio.blackunix.net:1723

kano.blackunix.com:1723

kill.blackunix.com:1723

kurtm.blackunix.com:1723

Mutex

1a9c91f6e0310d4f55b7ee7f22c2c9df

Attributes
  • reg_key

    1a9c91f6e0310d4f55b7ee7f22c2c9df

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe"
      2⤵
        PID:2756
      • C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\8082dc64e072c3c1c816fb10d54c5b46_JaffaCakes118.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4028

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2476-0-0x0000000074B22000-0x0000000074B23000-memory.dmp

      Filesize

      4KB

    • memory/2476-1-0x0000000074B20000-0x00000000750D1000-memory.dmp

      Filesize

      5.7MB

    • memory/2476-2-0x0000000074B20000-0x00000000750D1000-memory.dmp

      Filesize

      5.7MB

    • memory/2476-3-0x0000000074B20000-0x00000000750D1000-memory.dmp

      Filesize

      5.7MB

    • memory/2476-4-0x0000000074B20000-0x00000000750D1000-memory.dmp

      Filesize

      5.7MB

    • memory/2476-9-0x0000000074B22000-0x0000000074B23000-memory.dmp

      Filesize

      4KB

    • memory/2476-10-0x0000000074B20000-0x00000000750D1000-memory.dmp

      Filesize

      5.7MB

    • memory/4028-6-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/4028-7-0x0000000074B20000-0x00000000750D1000-memory.dmp

      Filesize

      5.7MB

    • memory/4028-8-0x0000000074B20000-0x00000000750D1000-memory.dmp

      Filesize

      5.7MB

    • memory/4028-11-0x0000000074B20000-0x00000000750D1000-memory.dmp

      Filesize

      5.7MB