Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
27-09-2021 18:28
General
-
Target
3441a429a71ac1ad6e910efdd06cacd3.exe
-
Size
315KB
-
MD5
3441a429a71ac1ad6e910efdd06cacd3
-
SHA1
d4f2ab9a718b2da7c4b1d1863dbc6a83b3e29264
-
SHA256
d3763d5c2317a279fc6ffce59700fb96f10570178d81c01a912db7b17811798c
-
SHA512
e9564dd693fc9391aa6d121c714e807820f2dce50c4809a11914274adfeec1ce721caf72b4801916fa35a9abcb078e3242ac2e28b54aa558ca0f54bf8dee5b8a
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
strigoo.duckdns.org:9889
Mutex
aed1603e66c64f9fafe
Attributes
-
reg_key
aed1603e66c64f9fafe
-
splitter
@!#&^%$
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3441a429a71ac1ad6e910efdd06cacd3.exe"C:\Users\Admin\AppData\Local\Temp\3441a429a71ac1ad6e910efdd06cacd3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2396-115-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/2396-117-0x0000000001210000-0x0000000001292000-memory.dmpFilesize
520KB
-
memory/2396-118-0x000000001C420000-0x000000001C482000-memory.dmpFilesize
392KB
-
memory/2396-119-0x000000001C410000-0x000000001C412000-memory.dmpFilesize
8KB
-
memory/2396-120-0x00000000010E0000-0x00000000010E8000-memory.dmpFilesize
32KB