Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-06-2024 23:01

General

  • Target

    04487fea5794d373da98f32d2a87778b_JaffaCakes118.exe

  • Size

    69KB

  • MD5

    04487fea5794d373da98f32d2a87778b

  • SHA1

    66088fe9dcf19108a12d7e5a0a61796ba2c5a886

  • SHA256

    48114ea6f8616e182b6f19ce8861a5d6014ef0c1d4377355b642e6a3355a4ed8

  • SHA512

    3c2f55b7e1adf69831cc7ecbcb053b9f7a82761cfcbc632358071b6ea3925a0c1c1f892a0d96646db6305b62f19b52db58372947bb68abb8c323822d30a41cb8

  • SSDEEP

    768:mXzzabcv30NuMkNNe1ZV6ieZopVqYU/9++WdoOkG5OoySP9SpcL1GbNg2sZ9K4pP:bjKaM/g+WuVpcL1GbNg2sZ9WmbF3

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

B HAT

Mutex

c3f67240befd41c0bbbef976afa47823

Attributes
  • reg_key

    c3f67240befd41c0bbbef976afa47823

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04487fea5794d373da98f32d2a87778b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04487fea5794d373da98f32d2a87778b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3128-0-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

    Filesize

    4KB

  • memory/3128-1-0x00000000003C0000-0x00000000003D8000-memory.dmp

    Filesize

    96KB

  • memory/3128-2-0x0000000004D60000-0x0000000004DFC000-memory.dmp

    Filesize

    624KB

  • memory/3128-3-0x0000000004C80000-0x0000000004C8C000-memory.dmp

    Filesize

    48KB

  • memory/3128-4-0x00000000053B0000-0x0000000005954000-memory.dmp

    Filesize

    5.6MB

  • memory/3128-5-0x0000000074A60000-0x0000000075210000-memory.dmp

    Filesize

    7.7MB

  • memory/3128-6-0x0000000004FA0000-0x0000000005032000-memory.dmp

    Filesize

    584KB

  • memory/3128-7-0x0000000004F60000-0x0000000004F6A000-memory.dmp

    Filesize

    40KB

  • memory/3128-8-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

    Filesize

    4KB

  • memory/3128-9-0x0000000074A60000-0x0000000075210000-memory.dmp

    Filesize

    7.7MB