Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
17/07/2024, 00:53
General
- Target 50cbbfcadf6bea41eb4475971908c175_JaffaCakes118.exe
- Size 39KB
- Sample240717-a8s52sycml
- SHA256 1a9e3baf6e93d070dce1fb7752a098613ef74cc24008fa9683277c3baa1ce2fb
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
B HAT
Mutex
-
1fcb8fb3a4794ae29f1b8ef01d138a35
Attributes
-
reg_key
1fcb8fb3a4794ae29f1b8ef01d138a35
-
splitter
|'|'|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50cbbfcadf6bea41eb4475971908c175_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\50cbbfcadf6bea41eb4475971908c175_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3672-0-0x00000000752AE000-0x00000000752AF000-memory.dmp
memory/3672-1-0x00000000007F0000-0x0000000000800000-memory.dmp
memory/3672-2-0x0000000002A10000-0x0000000002A1C000-memory.dmp
memory/3672-3-0x0000000005160000-0x00000000051FC000-memory.dmp
memory/3672-4-0x0000000005850000-0x0000000005DF4000-memory.dmp
memory/3672-5-0x00000000752A0000-0x0000000075A50000-memory.dmp
memory/3672-6-0x00000000053C0000-0x0000000005452000-memory.dmp
memory/3672-7-0x0000000005380000-0x000000000538A000-memory.dmp
memory/3672-8-0x00000000752AE000-0x00000000752AF000-memory.dmp
memory/3672-9-0x00000000752A0000-0x0000000075A50000-memory.dmp