Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-09-2021 13:09
Static task
static1
General
-
Target
836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe
-
Size
220KB
-
MD5
4d7c442ee41682bc23f89190f6d30ec9
-
SHA1
544d50cf853121d3b169084e7b7fdcbe0b0ec9a3
-
SHA256
836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d
-
SHA512
19135b7e3f9fc2ca6b5c5853dbe94c4bb287067b3efba95e84402c086c9c3eb8253545127883b531374c91de5aa9c401e8fef64a0884bcb270e4e7d1d8fc49d3
Malware Config
Extracted
Family
njrat
C2
ilfuoco.crabdance.com:1606
Mutex
2cdbd061ab
Attributes
-
reg_key
2cdbd061ab
-
splitter
@!#&^%$
Signatures
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exedescription pid process Token: SeDebugPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: 33 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe Token: SeIncBasePriorityPrivilege 800 836e0921a51d3e9bb91eb3a44f6cfe798dab4939b2ec5e6a39ff758db54e6b3d.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-114-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/800-116-0x0000000000F80000-0x0000000000FB5000-memory.dmpFilesize
212KB
-
memory/800-117-0x0000000000B40000-0x0000000000B4D000-memory.dmpFilesize
52KB
-
memory/800-118-0x0000000000B50000-0x0000000000B56000-memory.dmpFilesize
24KB
-
memory/800-119-0x000000001B430000-0x000000001B432000-memory.dmpFilesize
8KB