Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/10/2026, 16:54
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 43KB
- Sample261013-vehsfahs6m
- SHA256 9344528af21df243de0b6a2b0090a162f5f82dbe95abcd444c07a97ac8e74643
Malware Config
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
HacKed
-
192.168.1.49:8768
-
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes a file named after a Windows system binary 1 TTPs 3 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- Executes a file named after a Windows system binary
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe"2⤵
- Creates a file in the Startup directory
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp/Server.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp/Server.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Masquerading
1Match Legitimate Name or Location
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
Dllhost.exe
memory/2924-17-0x00000000746B0000-0x0000000074E6C000-memory.dmp
memory/2924-1-0x0000000000200000-0x0000000000212000-memory.dmp
memory/2924-2-0x0000000004CF0000-0x0000000004D8C000-memory.dmp
memory/2924-3-0x00000000055D0000-0x0000000005B8A000-memory.dmp
memory/2924-4-0x0000000005110000-0x00000000051A2000-memory.dmp
memory/2924-5-0x00000000746B0000-0x0000000074E6C000-memory.dmp
memory/2924-0-0x00000000746C2000-0x00000000746C3000-memory.dmp
memory/3388-22-0x00000000746B0000-0x0000000074E6C000-memory.dmp
memory/3388-21-0x00000000746B0000-0x0000000074E6C000-memory.dmp
memory/3388-26-0x00000000746B0000-0x0000000074E6C000-memory.dmp
memory/4160-16-0x00000000746B0000-0x0000000074E6C000-memory.dmp
memory/4160-20-0x00000000746B0000-0x0000000074E6C000-memory.dmp
memory/4160-15-0x00000000746B0000-0x0000000074E6C000-memory.dmp
memory/4160-23-0x00000000746B0000-0x0000000074E6C000-memory.dmp
memory/4160-27-0x00000000054A0000-0x00000000054AA000-memory.dmp