Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
22-12-2021 19:07
General
-
Target
476717531291FDE85E1713AC91F245AD.exe
-
Size
657KB
-
MD5
476717531291fde85e1713ac91f245ad
-
SHA1
97ce0130c7097df02def7ee1b587109b8cc629fc
-
SHA256
09f5ff5701d9c645272158ac98bcf3809d5b3f738c504b7725d61e09bf88ba03
-
SHA512
ffd8c29fd9ea7ebd1f04f6b2adf15b95e17f705533823f551ffb829ff174687399d57b8f504bd8c4a1db9a7834316294520846c91c03cfbb30b861eee1a2cd62
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
ronymahmoud.ddns.net:5050
Mutex
ec82c14e01cd4702a0
Attributes
-
reg_key
ec82c14e01cd4702a0
-
splitter
@!#&^%$
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\476717531291FDE85E1713AC91F245AD.exe"C:\Users\Admin\AppData\Local\Temp\476717531291FDE85E1713AC91F245AD.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
5.0MB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
40KB