njrat | 840645180a72cc443d3f56f11be2ea714f33ec709edbaa548dd3694451aa3790

General

Target

8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Size

383KB
MD5

8f4974c66f466ada4934acf0f1f34726
SHA1

449fe872676f8cfae5f642adef12180d25d18e85
SHA256

840645180a72cc443d3f56f11be2ea714f33ec709edbaa548dd3694451aa3790
SHA512

4c4053551757eb53c60aaca705aa59a7032f7a2e81094bb042a1b4b16a5c0a3adadab6fcf4368c91a33e20d536ee27cf04f75c1d1ebf11516ece1cc51d0ab274
SSDEEP

3072:20C4issn9XtuCkG6ZkDQNfj21k7v5vG+9UIrDBl6GO5Fl0BzISj/+kkad3pv8GF:20CrIGLQNbZ5R9JBRO5Fl0JjJLVag

Score

10^/10

njrat nyan cat trojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

asd2xxx.duckdns.org:1445

Mutex

0bcc55fde5b14a8

Attributes

reg_key
0bcc55fde5b14a8
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral1/memory/1300-1-0x0000000000900000-0x0000000000966000-memory.dmp	beds_protector

Suspicious use of SetThreadContext 1 IoCs

Processes:

8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe

description	pid	process	target process
PID 1300 set thread context of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: 33	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1724	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe

description	pid	process	target process
PID 1300 wrote to memory of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
PID 1300 wrote to memory of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
PID 1300 wrote to memory of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
PID 1300 wrote to memory of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
PID 1300 wrote to memory of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
PID 1300 wrote to memory of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
PID 1300 wrote to memory of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
PID 1300 wrote to memory of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
PID 1300 wrote to memory of 1724	1300	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe	8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1300

C:\Users\Admin\AppData\Local\Temp\8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f4974c66f466ada4934acf0f1f34726_JaffaCakes118.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1300-0-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download
memory/1300-1-0x0000000000900000-0x0000000000966000-memory.dmp

Filesize
408KB

Download
memory/1300-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1300-3-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/1300-17-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1724-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1724-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1724-11-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1724-13-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1724-4-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1724-16-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1724-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1724-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1724-15-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1724-18-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1724-19-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1724-20-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads