Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    06-09-2024 17:57

General

  • Target

    d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe

  • Size

    25KB

  • MD5

    d021f824c67eecb44f0cbecd3e34f707

  • SHA1

    9db6dbb01a9d9e7e6beda38c2ad2c5e84c205b41

  • SHA256

    38e488f67f251de64c399ed140e566929cd2e7a1b1b6357b8f4c7dbd35c15402

  • SHA512

    4134d296a6cf89fbd0ee75760f3f69fd79e19874014663b83be35763d35108b1fba34db1c0b40a835dd2af9b865897d1f7ef24aaff13ac0b30df65cc3d4e2b3b

  • SSDEEP

    384:sv3ZISLbyEgz6zJEj8+6xIpFhtyexhpIdM8rysFIUdt3aqkhzsOMMo:svp7yEU6zJoEcFzye2fusO4qqkBPY

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

46.158.156.37:27018

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2972-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

    Filesize

    4KB

  • memory/2972-1-0x0000000000A40000-0x0000000000A48000-memory.dmp

    Filesize

    32KB

  • memory/2972-2-0x00000000003C0000-0x00000000003D2000-memory.dmp

    Filesize

    72KB

  • memory/2972-3-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2972-5-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

    Filesize

    4KB

  • memory/2972-6-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

    Filesize

    9.9MB