Analysis
-
max time kernel
151s -
max time network
180s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 12:45
General
-
Target
4d7c442ee41682bc23f89190f6d30ec9.exe
-
Size
220KB
-
MD5
4d7c442ee41682bc23f89190f6d30ec9
-
SHA1
544d50cf853121d3b169084e7b7fdcbe0b0ec9a3
-
SHA256
836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d
-
SHA512
19135b7e3f9fc2ca6b5c5853dbe94c4bb287067b3efba95e84402c086c9c3eb8253545127883b531374c91de5aa9c401e8fef64a0884bcb270e4e7d1d8fc49d3
Score
10/10
Malware Config
Extracted
Family
njrat
C2
ilfuoco.crabdance.com:1606
Mutex
2cdbd061ab
Attributes
-
reg_key
2cdbd061ab
-
splitter
@!#&^%$
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d7c442ee41682bc23f89190f6d30ec9.exe"C:\Users\Admin\AppData\Local\Temp\4d7c442ee41682bc23f89190f6d30ec9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1120-60-0x0000000001070000-0x0000000001071000-memory.dmpFilesize
4KB
-
memory/1120-62-0x0000000000340000-0x0000000000375000-memory.dmpFilesize
212KB
-
memory/1120-63-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1120-64-0x0000000000410000-0x0000000000416000-memory.dmpFilesize
24KB
-
memory/1120-65-0x0000000000D30000-0x0000000000D32000-memory.dmpFilesize
8KB