Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:26
Behavioral task
behavioral1
Sample
5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe
-
Size
43KB
-
MD5
5b820c825e3b61334fddcfecec27e25d
-
SHA1
86076c48e65c4ec395f4f501280ed2f88f10667f
-
SHA256
5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4
-
SHA512
29297a698546a434d33cd69b5bb1c9447d8628f781c0792b7ce262b98c9ffd10487e015f7bf6c3cc5632828310dca58b8e99d734e1c165c3dda8f56fdbcce92f
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
127.0.0.1:1234
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exepid process 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exedescription pid process Token: SeDebugPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: 33 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: SeIncBasePriorityPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: 33 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: SeIncBasePriorityPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: 33 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: SeIncBasePriorityPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: 33 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: SeIncBasePriorityPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: 33 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: SeIncBasePriorityPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: 33 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: SeIncBasePriorityPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: 33 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: SeIncBasePriorityPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: 33 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: SeIncBasePriorityPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: 33 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe Token: SeIncBasePriorityPrivilege 1980 5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe"C:\Users\Admin\AppData\Local\Temp\5c959f3a27419cec7e99b5bbd3501a57b988806b4f32c655aeb4348e89278dc4.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken