Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08-09-2024 15:53

General

  • Target

    d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe

  • Size

    184KB

  • MD5

    d4b8a82a729cdf72567046b7555a0922

  • SHA1

    3f64f0fe9528075fd128d9a4d4591f15d095e268

  • SHA256

    66a12501efa03a9f5963f7b5bef2a4062e0e534ecc1a496cdc00cf60470d2e16

  • SHA512

    22304948535d84940b3f2aaf9ad6553865c3328c3ba897cc1c36928ec813127e41395a44dc5f2db3799bdeb7ae2491eeb6ffba8eff18d065860570839e19fb10

  • SSDEEP

    3072:BrSXkyxAljyuORbYlpy6bTH32GhNvtTw3LXdKkFq:xSkuAljyutpyCX2GhN1mLP

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

anunankis1.duckdns.org:1515

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe
        "C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2256
        • C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe
          "C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2944
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:2628
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Views/modifies file attributes
            PID:2636
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2328

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe

    Filesize

    184KB

    MD5

    d4b8a82a729cdf72567046b7555a0922

    SHA1

    3f64f0fe9528075fd128d9a4d4591f15d095e268

    SHA256

    66a12501efa03a9f5963f7b5bef2a4062e0e534ecc1a496cdc00cf60470d2e16

    SHA512

    22304948535d84940b3f2aaf9ad6553865c3328c3ba897cc1c36928ec813127e41395a44dc5f2db3799bdeb7ae2491eeb6ffba8eff18d065860570839e19fb10

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

    Filesize

    1KB

    MD5

    aab0594dc0ccf72394edb0350a86b3f1

    SHA1

    213f977d9d4b23d8ad554e86c2993d373bab6302

    SHA256

    cbd65a8650c6b50d91ccdede66a06aaf39709cbe2a8e18d0c96c7d5cbd8506ca

    SHA512

    dc4fd43d6641c93aed49613704bffab906cbc10f2aa7a3945ce02e6eff299c165cd459e8b047e836ae38871517bfdfe9b2e1fa59b45f9e28d429866b739da16e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

    Filesize

    1018B

    MD5

    e1d45e45044687dab3a6d0632db13944

    SHA1

    899a5d21fc82511f1958f529f7a8cb07fca318a9

    SHA256

    cf1c0a075333927031717773ab95451514e865ea03dfbbadfb4ec20316af0149

    SHA512

    7643e22b5b86ef3847ca78aa6c6bd6f00823e5277832750cf4bf00975088a7dfb4143ab97c50ebbac4698b062e452aaf01efc070fc3801cb82659800bed66690

  • memory/2096-0-0x0000000074E5E000-0x0000000074E5F000-memory.dmp

    Filesize

    4KB

  • memory/2096-1-0x00000000008B0000-0x00000000008E4000-memory.dmp

    Filesize

    208KB

  • memory/2096-2-0x0000000074E50000-0x000000007553E000-memory.dmp

    Filesize

    6.9MB

  • memory/2096-3-0x00000000003B0000-0x00000000003B8000-memory.dmp

    Filesize

    32KB

  • memory/2096-15-0x0000000074E50000-0x000000007553E000-memory.dmp

    Filesize

    6.9MB

  • memory/2256-26-0x00000000000A0000-0x00000000000D4000-memory.dmp

    Filesize

    208KB

  • memory/2944-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3048-12-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3048-14-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3048-4-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3048-16-0x0000000074E50000-0x000000007553E000-memory.dmp

    Filesize

    6.9MB

  • memory/3048-5-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3048-27-0x0000000074E50000-0x000000007553E000-memory.dmp

    Filesize

    6.9MB

  • memory/3048-6-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3048-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3048-10-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3048-7-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB