Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
27-09-2021 19:02
General
-
Target
3441a429a71ac1ad6e910efdd06cacd3.exe
-
Size
315KB
-
MD5
3441a429a71ac1ad6e910efdd06cacd3
-
SHA1
d4f2ab9a718b2da7c4b1d1863dbc6a83b3e29264
-
SHA256
d3763d5c2317a279fc6ffce59700fb96f10570178d81c01a912db7b17811798c
-
SHA512
e9564dd693fc9391aa6d121c714e807820f2dce50c4809a11914274adfeec1ce721caf72b4801916fa35a9abcb078e3242ac2e28b54aa558ca0f54bf8dee5b8a
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
strigoo.duckdns.org:9889
Mutex
aed1603e66c64f9fafe
Attributes
-
reg_key
aed1603e66c64f9fafe
-
splitter
@!#&^%$
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3441a429a71ac1ad6e910efdd06cacd3.exe"C:\Users\Admin\AppData\Local\Temp\3441a429a71ac1ad6e910efdd06cacd3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-53-0x000000013F5F0000-0x000000013F5F1000-memory.dmpFilesize
4KB
-
memory/1128-55-0x0000000000940000-0x00000000009C2000-memory.dmpFilesize
520KB
-
memory/1128-56-0x0000000002130000-0x0000000002192000-memory.dmpFilesize
392KB
-
memory/1128-57-0x00000000009E0000-0x00000000009E8000-memory.dmpFilesize
32KB
-
memory/1128-58-0x000000001BC10000-0x000000001BC12000-memory.dmpFilesize
8KB