njrat | 64d7d58724fe40787f7fdcb2496f96206c538fb80c14fc8827f4e5af9a5c99c8

General

Target

a7c7bb532823a6e7d4ace596f146c618.exe
Size

113KB
MD5

a7c7bb532823a6e7d4ace596f146c618
SHA1

d4ce3acc8b40a6880e5c57c9ec5844643413e312
SHA256

64d7d58724fe40787f7fdcb2496f96206c538fb80c14fc8827f4e5af9a5c99c8
SHA512

51f14f96d6935f336fd224319b1706f9a6d21251c568292574d564b28741ebae8647cb0fca737073ac763e3bd61a0c751538255671c542859d733494a0a566d9

Score

10^/10

Family

njrat

Version

0.7d

Botnet

Run RunPE

Attributes

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

a7c7bb532823a6e7d4ace596f146c618.exe

description pid process target process

PID 1936 set thread context of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe

description	pid	process	target process
PID 1936 set thread context of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe
Token: 33	1744	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1744	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a7c7bb532823a6e7d4ace596f146c618.exe

description	pid	process	target process
PID 1936 wrote to memory of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe
PID 1936 wrote to memory of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe
PID 1936 wrote to memory of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe
PID 1936 wrote to memory of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe
PID 1936 wrote to memory of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe
PID 1936 wrote to memory of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe
PID 1936 wrote to memory of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe
PID 1936 wrote to memory of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe
PID 1936 wrote to memory of 1744	1936	a7c7bb532823a6e7d4ace596f146c618.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744

memory/1744-57-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1744-58-0x000000000040FD1E-mapping.dmp

Download
memory/1744-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1744-61-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/1936-53-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1936-55-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/1936-56-0x00000000004E0000-0x00000000004E7000-memory.dmp

Filesize
28KB

Download