Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:34
Behavioral task
behavioral1
Sample
9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe
-
Size
43KB
-
MD5
df31c83efef6b1f2fa1855b57c94a365
-
SHA1
6b4e4345af409c4629f22a06b469069d72f7e589
-
SHA256
9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661
-
SHA512
fa70e26664c169c1f80d98eab7687f7b950162147e223f6bf089e3d6487efa7fa66878f16b2f1594b7fa89b4e639735faab682f9e23c74ce0802b0953c7caae6
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
127.0.0.1:5552
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exepid process 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exedescription pid process Token: SeDebugPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: 33 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe Token: SeIncBasePriorityPrivilege 3748 9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe"C:\Users\Admin\AppData\Local\Temp\9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3748-130-0x0000000000BB0000-0x0000000000BC2000-memory.dmpFilesize
72KB
-
memory/3748-131-0x00000000055E0000-0x000000000567C000-memory.dmpFilesize
624KB
-
memory/3748-132-0x0000000005ED0000-0x0000000006474000-memory.dmpFilesize
5.6MB
-
memory/3748-133-0x00000000059C0000-0x0000000005A52000-memory.dmpFilesize
584KB
-
memory/3748-134-0x0000000005930000-0x000000000593A000-memory.dmpFilesize
40KB