Overview

overview

10

Static

static

b96d0b747d...bb.exe

windows7_x64

10

b96d0b747d...bb.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 18:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b96d0b747d9ada9349495efee61d8c04beccc4bb7c3ab5ea794a5b0dffd9a5bb.exe

  • Size

    25KB

  • MD5

    61d42a9ef8ab1ae1f90f79ee3f41d7cd

  • SHA1

    9a52b27d80a084e5b69207e97337c36d03ea5b70

  • SHA256

    b96d0b747d9ada9349495efee61d8c04beccc4bb7c3ab5ea794a5b0dffd9a5bb

  • SHA512

    f821d61060ae63d471cc37e04725265424dad82da64dc6b575dbb3c498d461e6fd56cc4243b58b0e5462b4d545baf09c26d1276050bde870a514ddffce3daeac

Score
10/10
njrathackedsuricatatrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

0.tcp.ngrok.io:17307

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b96d0b747d9ada9349495efee61d8c04beccc4bb7c3ab5ea794a5b0dffd9a5bb.exe
    "C:\Users\Admin\AppData\Local\Temp\b96d0b747d9ada9349495efee61d8c04beccc4bb7c3ab5ea794a5b0dffd9a5bb.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1984-54-0x0000000000DA0000-0x0000000000DA8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1984-55-0x00000000003C0000-0x00000000003D2000-memory.dmp
    Filesize

    72KB

    Download