njrat | b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998

Analysis

max time kernel
13s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe
Size

83KB
MD5

0acd52a5eca19fdfd3c23682a1565500
SHA1

c040443641a2c61b5b67fc3ad235f38cad4d7089
SHA256

b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998
SHA512

bdef13b46a37007330ecb2c3570eda3f3db3fad138a70f91cbbaf1e1563188e7485106048f79aca92d8396a6a5bf37c75a97592fdd2ebcd7aae363fd057a9ba0
SSDEEP

1536:OOdnis2oXPfq+ZCcXrz5izuVId/eVtF/1YadXenbooNPqc3soAI3QN0qSS:OOdnis2oX3q+Mcb11Y/e/F/1YSU5NPqV

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

xplackx.no-ip.biz:1177

Mutex

08f4dc96bbb7af09d1a37fe35c75a42f

Attributes

reg_key
08f4dc96bbb7af09d1a37fe35c75a42f
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4220 set thread context of 448	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe	82

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe
Token: 33	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe
Token: SeIncBasePriorityPrivilege	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 448	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe	82
PID 4220 wrote to memory of 448	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe	82
PID 4220 wrote to memory of 448	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe	82
PID 4220 wrote to memory of 448	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe	82
PID 4220 wrote to memory of 448	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe	82
PID 4220 wrote to memory of 448	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe	82
PID 4220 wrote to memory of 448	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe	82
PID 4220 wrote to memory of 448	4220	b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe	82

C:\Users\Admin\AppData\Local\Temp\b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe
"C:\Users\Admin\AppData\Local\Temp\b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe
  C:\Users\Admin\AppData\Local\Temp\b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe
  2⤵
  PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\b38b021a1c25c05b6817a52e0ad8b36a8b64000db99e1b066114b30e28084998.exe.log

Filesize
496B

MD5
475e8295d9b6cb38cc702066e51dd553

SHA1
5b9b7eb71d5a729213aeb4e4419f83c10f9bd07a

SHA256
eb206cb8cabacc7e12f6cc2c3843c0004e3aaaeebd7cb2ac335524cb055cc0dc

SHA512
9b6a137e0ae421f9c78e4bf0a96889ba4d59f197d6ef3c1552bc932680799c6fd4fdeef7642a9d8a8b2fd9ca4c8c657a2cc4129ec5aba2423a854c7eaaf1f544

Download Submit
memory/448-134-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/448-137-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download
memory/4220-132-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download
memory/4220-136-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download