Overview

overview

10

Static

static

B622BC1010...1B.exe

windows7_x64

10

B622BC1010...1B.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    12-12-2021 11:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    B622BC1010F3092F15D23C72E07B755236C7D537A211B.exe

  • Size

    2.1MB

  • MD5

    be7978477876f7ad6cfb8aa7e23d0f8a

  • SHA1

    6da15280247d06c9f58cf77a2b532d18117f3d89

  • SHA256

    b622bc1010f3092f15d23c72e07b755236c7d537a211b39c4d4de7711a5052eb

  • SHA512

    3dc64ff5cb4bfe713d0aab32e42f4a21a222fe0c13cc649c0c6d7ed51a354bde7471c94981177d56e91b4459a3e565ba3f4c13cef731cfca00bb4c23917f91cc

Score
10/10
njratnyan catsuricatatrojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

milla.publicvm.com:5050

Mutex

c3218b1f59

Attributes
  • reg_key

    c3218b1f59

  • splitter

    @!#&^%$

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\B622BC1010F3092F15D23C72E07B755236C7D537A211B.exe
    "C:\Users\Admin\AppData\Local\Temp\B622BC1010F3092F15D23C72E07B755236C7D537A211B.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/692-115-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/692-117-0x0000000003300000-0x0000000003301000-memory.dmp
    Filesize

    4KB

    Download
  • memory/692-118-0x00000000062E0000-0x00000000062E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/692-119-0x0000000005950000-0x0000000005958000-memory.dmp
    Filesize

    32KB

    Download
  • memory/692-120-0x0000000006890000-0x0000000006891000-memory.dmp
    Filesize

    4KB

    Download
  • memory/692-121-0x0000000006530000-0x0000000006531000-memory.dmp
    Filesize

    4KB

    Download
  • memory/692-122-0x00000000064B0000-0x00000000064B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/692-123-0x0000000006730000-0x0000000006731000-memory.dmp
    Filesize

    4KB

    Download