njrat | cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9

General

Target

cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Size

235KB
MD5

e796c19f8f06955108bd82ae44bbdb47
SHA1

05ca631c873d6cad59c1d39fcf4f555fd7ca2117
SHA256

cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9
SHA512

d2599d31fe8d67841c09022790f5597197ac97f2e39189b9b0b401ee20882b72e835158d5f9e1bc3ba0448208d4ad8e586114e2a389f7ba9f147472884f24777

Score

10^/10

njrat topher trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

topher

C2

23.237.25.124:1234

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe

pid process

1012 cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe

pid	process
1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe

description	pid	process
Token: SeDebugPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: 33	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
Token: SeIncBasePriorityPrivilege	1012	cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe

C:\Users\Admin\AppData\Local\Temp\cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe
"C:\Users\Admin\AppData\Local\Temp\cf1d9a9b23dda4b23bfc5a8702f4e8d3e3cb6927e56bd3c911e09010e78244f9.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-54-0x0000000000E00000-0x0000000000E42000-memory.dmp

Filesize
264KB

Download
memory/1012-55-0x0000000000370000-0x0000000000382000-memory.dmp

Filesize
72KB

Download
memory/1012-56-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Filesize
6.9MB

Download
memory/1012-57-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing