Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240729-en - resource tags
- submitted
27/07/2024, 04:48
General
- Target 771b76e2b2e7a9f6836e2764091feb12_JaffaCakes118.exe
- Size 239KB
- Sample240727-ffhrha1fmd
- SHA256 f53122e0bd14f7802c28d21dde5b34a7010c302327c3526bd73e769d9a2835ad
Malware Config
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
HacKed
-
92.240.245.188:5552
-
Windows
-
reg_key
Windows
-
splitter
|Hassan|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Drops startup file 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\771b76e2b2e7a9f6836e2764091feb12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\771b76e2b2e7a9f6836e2764091feb12_JaffaCakes118.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4492-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp
memory/4492-1-0x00000000004C0000-0x0000000000502000-memory.dmp
memory/4492-2-0x0000000004EB0000-0x0000000004F4C000-memory.dmp
memory/4492-3-0x0000000074D80000-0x0000000075530000-memory.dmp
memory/4492-4-0x0000000004E10000-0x0000000004E22000-memory.dmp
memory/4492-5-0x0000000005620000-0x0000000005BC4000-memory.dmp
memory/4492-6-0x0000000005310000-0x00000000053A2000-memory.dmp
memory/4492-8-0x00000000053B0000-0x00000000053BA000-memory.dmp
memory/4492-9-0x0000000074D8E000-0x0000000074D8F000-memory.dmp
memory/4492-10-0x0000000074D80000-0x0000000075530000-memory.dmp