njrat | 239f8ee37ff56230ece8b50161673626c860f58ae099b1fc60f6c73ebc8d5e4a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/01/2025, 12:26

Target

JaffaCakes118_6c9ea48a1adacdda5e81cb681def0ff0.exe
Size

254KB
MD5

6c9ea48a1adacdda5e81cb681def0ff0
SHA1

3b39e2605030d367607eb05b8a9f659c4ec800f1
SHA256

239f8ee37ff56230ece8b50161673626c860f58ae099b1fc60f6c73ebc8d5e4a
SHA512

92e385b17fee687ee801e45ac62c64080b3c47caf7fff1792aa0cfb8749012918a47d8d804c63c8547f46d0f72d01e744da390ff871ffb3016eb8b84ded89109
SSDEEP

6144:vSdmouW951HZDeXGGOhz8gEhnzeENxunCPL:vnE95VZDgOhuhz1NxBP

Score

10^/10

njrat trojan

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2380	2544	JaffaCakes118_6c9ea48a1adacdda5e81cb681def0ff0.exe	30
PID 2544 wrote to memory of 2380	2544	JaffaCakes118_6c9ea48a1adacdda5e81cb681def0ff0.exe	30
PID 2544 wrote to memory of 2380	2544	JaffaCakes118_6c9ea48a1adacdda5e81cb681def0ff0.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c9ea48a1adacdda5e81cb681def0ff0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c9ea48a1adacdda5e81cb681def0ff0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 416
  2⤵
  PID:2380

memory/2380-4-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2544-0-0x000007FEF682E000-0x000007FEF682F000-memory.dmp

Filesize
4KB

Download
memory/2544-1-0x00000000007F0000-0x0000000000830000-memory.dmp

Filesize
256KB

Download
memory/2544-2-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2544-3-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

Filesize
9.6MB

Download
memory/2544-5-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

Filesize
9.6MB

Download