njrat | 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed

General

Target

1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe
Size

1.0MB
MD5

08d5c4483e2106305bc73d6456455f2e
SHA1

ee5c737012942806df0a834ebd3914bd8bb19702
SHA256

1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed
SHA512

1c4dbc3273b617704d78e35c5903c6872bb904249f84ae2de5facd9cf2f365d3a9de9e4eccca6a624e9b922dcf856c052e299485d34df22a097dbbfc4ac6952a

Score

10^/10

njrat zzzzzzquarentinee trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

ZZZZZZQUARENTINEE

C2

tonystark2025.duckdns.org:4010

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
1234

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 1 IoCs

Processes:

1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AssignedAccessManager.url	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe

description	pid	process	target process
PID 528 set thread context of 1876	528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe
Token: 33	1876	MSBuild.exe
Token: SeIncBasePriorityPrivilege	1876	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe

pid	process
528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe
528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe
528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe

pid	process
528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe
528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe
528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe

description	pid	process	target process
PID 528 wrote to memory of 1876	528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe	MSBuild.exe
PID 528 wrote to memory of 1876	528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe	MSBuild.exe
PID 528 wrote to memory of 1876	528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe	MSBuild.exe
PID 528 wrote to memory of 1876	528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe	MSBuild.exe
PID 528 wrote to memory of 1876	528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe	MSBuild.exe
PID 528 wrote to memory of 1876	528	1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe
"C:\Users\Admin\AppData\Local\Temp\1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/528-62-0x00000000001A0000-0x00000000001C8000-memory.dmp

Filesize
160KB

Download
memory/528-63-0x0000000000290000-0x00000000002B8000-memory.dmp

Filesize
160KB

Download
memory/1876-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1876-56-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1876-61-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1876-64-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1876-65-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads