Analysis
-
max time kernel
152s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-09-2021 18:28
General
-
Target
3441a429a71ac1ad6e910efdd06cacd3.exe
-
Size
315KB
-
MD5
3441a429a71ac1ad6e910efdd06cacd3
-
SHA1
d4f2ab9a718b2da7c4b1d1863dbc6a83b3e29264
-
SHA256
d3763d5c2317a279fc6ffce59700fb96f10570178d81c01a912db7b17811798c
-
SHA512
e9564dd693fc9391aa6d121c714e807820f2dce50c4809a11914274adfeec1ce721caf72b4801916fa35a9abcb078e3242ac2e28b54aa558ca0f54bf8dee5b8a
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
strigoo.duckdns.org:9889
Mutex
aed1603e66c64f9fafe
Attributes
-
reg_key
aed1603e66c64f9fafe
-
splitter
@!#&^%$
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3441a429a71ac1ad6e910efdd06cacd3.exe"C:\Users\Admin\AppData\Local\Temp\3441a429a71ac1ad6e910efdd06cacd3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1496-60-0x000000013F180000-0x000000013F181000-memory.dmpFilesize
4KB
-
memory/1496-62-0x00000000007F0000-0x0000000000872000-memory.dmpFilesize
520KB
-
memory/1496-63-0x00000000023E0000-0x0000000002442000-memory.dmpFilesize
392KB
-
memory/1496-64-0x000000001BAB0000-0x000000001BAB2000-memory.dmpFilesize
8KB
-
memory/1496-65-0x0000000000880000-0x0000000000888000-memory.dmpFilesize
32KB