Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-09-2021 12:45
Static task
static1
Behavioral task
behavioral1
Sample
4d7c442ee41682bc23f89190f6d30ec9.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
4d7c442ee41682bc23f89190f6d30ec9.exe
-
Size
220KB
-
MD5
4d7c442ee41682bc23f89190f6d30ec9
-
SHA1
544d50cf853121d3b169084e7b7fdcbe0b0ec9a3
-
SHA256
836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d
-
SHA512
19135b7e3f9fc2ca6b5c5853dbe94c4bb287067b3efba95e84402c086c9c3eb8253545127883b531374c91de5aa9c401e8fef64a0884bcb270e4e7d1d8fc49d3
Malware Config
Extracted
Family
njrat
C2
ilfuoco.crabdance.com:1606
Mutex
2cdbd061ab
Attributes
-
reg_key
2cdbd061ab
-
splitter
@!#&^%$
Signatures
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
4d7c442ee41682bc23f89190f6d30ec9.exedescription pid process Token: SeDebugPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: 33 664 4d7c442ee41682bc23f89190f6d30ec9.exe Token: SeIncBasePriorityPrivilege 664 4d7c442ee41682bc23f89190f6d30ec9.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/664-116-0x0000000001000000-0x0000000001035000-memory.dmpFilesize
212KB
-
memory/664-117-0x0000000000F80000-0x0000000000F8D000-memory.dmpFilesize
52KB
-
memory/664-118-0x0000000000FA0000-0x0000000000FA6000-memory.dmpFilesize
24KB
-
memory/664-119-0x000000001B2F0000-0x000000001B2F2000-memory.dmpFilesize
8KB