njrat | 0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f

Analysis

max time kernel
83s
max time network
1s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 04:26

Target

0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe
Size

84KB
MD5

7bbc003e166272bc667908af36182533
SHA1

13bc9804004ad6cb6de642f35f151f2c7826a06b
SHA256

0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f
SHA512

f3d533243face989d66dca7753a96cac441e2f2f2fc2418900c91aae2c1dcf9639dbac9a0fc8853bc59c7fee3ba4c6f2a8481c1b47f2e4b1c7d854a366102cb9
SSDEEP

1536:1yVLGnj/2JXyD/HTKKjkVUxJGXhlp1lTTd03wZ:uLq/UqfTHoVUy1ZTGM

Score

10^/10

njrat trojan

Executes dropped EXE 1 IoCs

pid	Process
3488	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4780 set thread context of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81
PID 4780 wrote to memory of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81
PID 4780 wrote to memory of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81
PID 4780 wrote to memory of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81
PID 4780 wrote to memory of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81
PID 4780 wrote to memory of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81
PID 4780 wrote to memory of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81
PID 4780 wrote to memory of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81
PID 4780 wrote to memory of 3488	4780	0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe	81

C:\Users\Admin\AppData\Local\Temp\0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe
"C:\Users\Admin\AppData\Local\Temp\0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\0f19e67b11f5a34ec20fa7cd563dbc005f65f3a91afb36dce844e098bd9c193f.exe"
  2⤵
  - Executes dropped EXE
  PID:3488

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
19KB

MD5
b5275201d50fada3f304792b58185fd3

SHA1
b1a124b79552a6d1fb411a56e7da12c77db31913

SHA256
3e49384b9791bacd26d1176e1523930282ccc240714e7a80d3a60ed15cca2b44

SHA512
c011d9848bceefe964354311f3f37b1bc453d594c62f5ebb67fc1d1f5c82d096d44ed3524d74045b72ec4b99ec5ca19802d8e12bdfa9780ab52630c16fbee0a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
6KB

MD5
d9513dba296ac27b5ace248502c9ce35

SHA1
1b830fd0daee6604b6881ecea6ac13fc8b0f6d4c

SHA256
e958f0190bd4d302d5aa2605f0e606582a26413970a0dd1378917f580bd98baa

SHA512
6a1b46559eb9131b690932f2be572617412b6fbb0e382e90a4c730cc58b3342673e632c9ed894b15ad5f040ec4bf0573736ca6e1d6ad74d6555f709413ffd6b6

Download Submit
memory/3488-136-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4780-134-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download