Overview

overview

10

Static

static

B622BC1010...1B.exe

windows7_x64

10

B622BC1010...1B.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    12-12-2021 11:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    B622BC1010F3092F15D23C72E07B755236C7D537A211B.exe

  • Size

    2.1MB

  • MD5

    be7978477876f7ad6cfb8aa7e23d0f8a

  • SHA1

    6da15280247d06c9f58cf77a2b532d18117f3d89

  • SHA256

    b622bc1010f3092f15d23c72e07b755236c7d537a211b39c4d4de7711a5052eb

  • SHA512

    3dc64ff5cb4bfe713d0aab32e42f4a21a222fe0c13cc649c0c6d7ed51a354bde7471c94981177d56e91b4459a3e565ba3f4c13cef731cfca00bb4c23917f91cc

Score
10/10
njratnyan catsuricatatrojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

milla.publicvm.com:5050

Mutex

c3218b1f59

Attributes
  • reg_key

    c3218b1f59

  • splitter

    @!#&^%$

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\B622BC1010F3092F15D23C72E07B755236C7D537A211B.exe
    "C:\Users\Admin\AppData\Local\Temp\B622BC1010F3092F15D23C72E07B755236C7D537A211B.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/844-54-0x0000000000A90000-0x0000000000A91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/844-56-0x0000000076151000-0x0000000076153000-memory.dmp
    Filesize

    8KB

    Download
  • memory/844-57-0x0000000004F30000-0x0000000004F31000-memory.dmp
    Filesize

    4KB

    Download
  • memory/844-58-0x0000000000230000-0x0000000000238000-memory.dmp
    Filesize

    32KB

    Download