Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    24-09-2021 13:09

General

  • Target

    836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe

  • Size

    220KB

  • MD5

    4d7c442ee41682bc23f89190f6d30ec9

  • SHA1

    544d50cf853121d3b169084e7b7fdcbe0b0ec9a3

  • SHA256

    836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d

  • SHA512

    19135b7e3f9fc2ca6b5c5853dbe94c4bb287067b3efba95e84402c086c9c3eb8253545127883b531374c91de5aa9c401e8fef64a0884bcb270e4e7d1d8fc49d3

Score
10/10

Malware Config

Extracted

Family

njrat

C2

ilfuoco.crabdance.com:1606

Mutex

2cdbd061ab

Attributes
  • reg_key

    2cdbd061ab

  • splitter

    @!#&^%$

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe
    "C:\Users\Admin\AppData\Local\Temp\836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/800-114-0x00000000006F0000-0x00000000006F1000-memory.dmp
    Filesize

    4KB

  • memory/800-116-0x0000000000F80000-0x0000000000FB5000-memory.dmp
    Filesize

    212KB

  • memory/800-117-0x0000000000B40000-0x0000000000B4D000-memory.dmp
    Filesize

    52KB

  • memory/800-118-0x0000000000B50000-0x0000000000B56000-memory.dmp
    Filesize

    24KB

  • memory/800-119-0x000000001B430000-0x000000001B432000-memory.dmp
    Filesize

    8KB