Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-12-2021 11:11
General
-
Target
B622BC1010F3092F15D23C72E07B755236C7D537A211B.exe
-
Size
2.1MB
-
MD5
be7978477876f7ad6cfb8aa7e23d0f8a
-
SHA1
6da15280247d06c9f58cf77a2b532d18117f3d89
-
SHA256
b622bc1010f3092f15d23c72e07b755236c7d537a211b39c4d4de7711a5052eb
-
SHA512
3dc64ff5cb4bfe713d0aab32e42f4a21a222fe0c13cc649c0c6d7ed51a354bde7471c94981177d56e91b4459a3e565ba3f4c13cef731cfca00bb4c23917f91cc
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
milla.publicvm.com:5050
Mutex
c3218b1f59
Attributes
-
reg_key
c3218b1f59
-
splitter
@!#&^%$
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\B622BC1010F3092F15D23C72E07B755236C7D537A211B.exe"C:\Users\Admin\AppData\Local\Temp\B622BC1010F3092F15D23C72E07B755236C7D537A211B.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
32KB