njrat | 2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b

Analysis

max time kernel
69s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 18:34

Target

2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
Size

800KB
MD5

016945e2ea7dabd27551ea79fd7643f0
SHA1

07e3da237bee81ac593b171cee87ab6806128ae4
SHA256

2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b
SHA512

433ae6e459819626ed9b0f9670106c1efa4fef0eef15fd53afadd9993615cf81dac2ed67c70f6c424a59cbf1ca88e51ae2dd7c53f93061b96509ab7482ebe9f1
SSDEEP

12288:bm3QTAh7ZSi2Gbprau0WkWZl3eRkKPodZ3j9eEJIc4GZxHzuC/fh+aI5jw1E276l:mEqYGbprau0WkWZl3eRkKPoHk4uC/

Score

10^/10

njrat trojan

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 912	1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	26

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 912	1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	26
PID 1416 wrote to memory of 912	1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	26
PID 1416 wrote to memory of 912	1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	26
PID 1416 wrote to memory of 912	1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	26
PID 1416 wrote to memory of 912	1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	26
PID 1416 wrote to memory of 912	1416	2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe	26

C:\Users\Admin\AppData\Local\Temp\2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
"C:\Users\Admin\AppData\Local\Temp\2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
  C:\Users\Admin\AppData\Local\Temp\2f214ff6557c5ae4db66f26e1657fc6896d8bcf48fa800f4bd0e992e598dc86b.exe
  2⤵
  PID:912

memory/912-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/912-60-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/912-62-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/912-64-0x00000000004F0000-0x00000000004FA000-memory.dmp

Filesize
40KB

Download
memory/912-65-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/912-67-0x0000000000570000-0x000000000057E000-memory.dmp

Filesize
56KB

Download
memory/1416-54-0x0000000000920000-0x00000000009EE000-memory.dmp

Filesize
824KB

Download
memory/1416-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download
memory/1416-66-0x0000000004EF5000-0x0000000004F06000-memory.dmp

Filesize
68KB

Download
memory/1416-68-0x0000000004EF5000-0x0000000004F06000-memory.dmp

Filesize
68KB

Download