njrat | 68b918b94a1a611c54eacfbd0735717757102143266eac04bc66038ed26683b6 | Triage

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 18:08

Sharing

Report Analysis Logs

General

Target

68b918b94a1a611c54eacfbd0735717757102143266eac04bc66038ed26683b6.exe
Size

1.6MB
MD5

5af9c1b99ceb67a23bb4a86407836916
SHA1

dd6d48aa2a2cb50566360188d38cbb475a05c26a
SHA256

68b918b94a1a611c54eacfbd0735717757102143266eac04bc66038ed26683b6
SHA512

8a6c1954df0c6a97de0f614eac9a8346a0d218a7b9013abdac7634444cc1bddc9a21c2b6b380741a50864703eab096667135d4d47ecbbd54ee4968fbe7dc2242
SSDEEP

12288:Xq9DhxyGfPDNiW5SggSe+RlB7p+/eeRfC+5obGfkpQNboVo4Chj0QCKLX8gcBdR1:IPDYkrpyT0kt9lsJqGL6MLSd6Ogrx9

Score

10^/10

njrat trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\68b918b94a1a611c54eacfbd0735717757102143266eac04bc66038ed26683b6.exe
"C:\Users\Admin\AppData\Local\Temp\68b918b94a1a611c54eacfbd0735717757102143266eac04bc66038ed26683b6.exe"
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-54-0x0000000000B00000-0x0000000000CA0000-memory.dmp

Filesize
1.6MB

Download
memory/1108-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1108-56-0x00000000007E0000-0x00000000007EC000-memory.dmp

Filesize
48KB

Download