Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/01/2025, 22:06
General
- Target JaffaCakes118_7c1d6e22ea6de18bbbc8d944ae1390f0.exe
- Size 95KB
- Sample250104-11krta1raq
- SHA256 23177f2f6b1e1b33c7b10f6602051994fa952a21a4cbb170004f04357f50e41e
Malware Config
Extracted
-
njrat
-
0.6.4
-
HacKed
-
superstart.myq-see.com:1177
-
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
- Njrat family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1d6e22ea6de18bbbc8d944ae1390f0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1d6e22ea6de18bbbc8d944ae1390f0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
Trojan.exe
memory/2096-8-0x00000000014A0000-0x00000000014AC000-memory.dmp
memory/2096-1-0x00007FF909C00000-0x00007FF90A5A1000-memory.dmp
memory/2096-3-0x00007FF909C00000-0x00007FF90A5A1000-memory.dmp
memory/2096-4-0x00000000012B0000-0x00000000012BC000-memory.dmp
memory/2096-5-0x000000001BF30000-0x000000001C066000-memory.dmp
memory/2096-6-0x000000001C540000-0x000000001CA0E000-memory.dmp
memory/2096-7-0x00000000012C0000-0x00000000012CC000-memory.dmp
memory/2096-0-0x00007FF909EB5000-0x00007FF909EB6000-memory.dmp
memory/2096-2-0x0000000001180000-0x000000000118A000-memory.dmp
memory/2096-9-0x00000000014B0000-0x00000000014BE000-memory.dmp
memory/2096-10-0x000000001CEF0000-0x000000001CF96000-memory.dmp
memory/2096-23-0x00007FF909C00000-0x00007FF90A5A1000-memory.dmp
memory/2820-24-0x00007FF909C00000-0x00007FF90A5A1000-memory.dmp
memory/2820-25-0x00007FF909C00000-0x00007FF90A5A1000-memory.dmp
memory/2820-26-0x00007FF909C00000-0x00007FF90A5A1000-memory.dmp
memory/2820-27-0x000000001C980000-0x000000001CA1C000-memory.dmp
memory/2820-28-0x0000000000CC0000-0x0000000000CC8000-memory.dmp
memory/2820-29-0x00007FF909C00000-0x00007FF90A5A1000-memory.dmp