Analysis
-
max time kernel
149s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:26
Static task
static1
Behavioral task
behavioral1
Sample
92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
General
-
Target
92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe
-
Size
71KB
-
MD5
2ce6aba90352c5872d3e03520e6f7712
-
SHA1
371728cfd3f6d241c87b40d11d823f6db1a8e7b6
-
SHA256
92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30
-
SHA512
835409e305a24f9f957eff09a5b9b9371f0079dee8ef1c4c4c7acd52bf673d04b0c0a7c632d20f8466c8293bcfe0093e2134c88075d04f5e56e55a4399199fc0
-
SSDEEP
768:FJnTfAiBOTUzGXMonQuiikFXb/o9PVE2y6Ox4714BHi0H:7MiBORBeikRolVE2A47CfH
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
B HAT
Mutex
59fc68913a114f1f97d5af6749ad3f0e
Attributes
-
reg_key
59fc68913a114f1f97d5af6749ad3f0e
-
splitter
|'|'|
Signatures
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exedescription pid process Token: SeDebugPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: 33 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe Token: SeIncBasePriorityPrivilege 1480 92c4af5dabbf13b6849b389c6e1c181eb2fa5778136658cebf50a8575fc3db30.exe