Analysis
-
max time kernel
193s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:29
Behavioral task
behavioral1
Sample
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe
-
Size
43KB
-
MD5
92800272c08213ac0e30a3e7ea34aebb
-
SHA1
63bdc8c65edb72edff6edcb529f7bb18dff62b6c
-
SHA256
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1
-
SHA512
04f160166a81d08cdd236a56f484b4ff947636762a62a2167b2d1db07109d25c4909e9a207b37c1affc3e3a05e835ab68c2ede5ca69db9e99c345837aaaf0977
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
misha104.ddns.net:5552
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exepid process 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exedescription pid process Token: SeDebugPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: 33 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe Token: SeIncBasePriorityPrivilege 4928 61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe"C:\Users\Admin\AppData\Local\Temp\61f2af5877d4f8627940d104b13a960a1106075e7a9823bf6737373a21dcfed1.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4928-130-0x00000000005F0000-0x0000000000602000-memory.dmpFilesize
72KB
-
memory/4928-131-0x0000000004FB0000-0x000000000504C000-memory.dmpFilesize
624KB
-
memory/4928-132-0x00000000058A0000-0x0000000005E44000-memory.dmpFilesize
5.6MB
-
memory/4928-133-0x0000000005390000-0x0000000005422000-memory.dmpFilesize
584KB
-
memory/4928-134-0x0000000005370000-0x000000000537A000-memory.dmpFilesize
40KB