Analysis
-
max time kernel
151s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:26
Static task
static1
Behavioral task
behavioral1
Sample
d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe
Resource
win10v2004-20221111-en
General
-
Target
d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe
-
Size
237KB
-
MD5
d3588affd317d7994a8a1488437aa951
-
SHA1
f35b3ecb788187b811b66db394a3bdb59fe68152
-
SHA256
d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0
-
SHA512
ee50fcb6d8ade03f2ebf50e1784e2a50b5bccc23b67ffd33d7fe6fd77a75d4a70dc0bc4a2ee781bdb284e996f2c663ca52f8b2bb284503e28c75e55e76daa9d5
-
SSDEEP
768:VXi9Z3uVe/5zq5LrP0DyRyRwXC1CKlGlR5BcBhfOpRvX85QywGkFESH9EaCUn1dP:Vg/5zKLrcDU0wyUKALYhfOOg
Malware Config
Extracted
njrat
0.7d
ByteArray
-
splitter
|'|'|
Signatures
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exedescription pid process Token: SeDebugPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: 33 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: SeIncBasePriorityPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: 33 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: SeIncBasePriorityPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: 33 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: SeIncBasePriorityPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: 33 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: SeIncBasePriorityPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: 33 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: SeIncBasePriorityPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: 33 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: SeIncBasePriorityPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: 33 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: SeIncBasePriorityPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: 33 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: SeIncBasePriorityPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: 33 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe Token: SeIncBasePriorityPrivilege 1156 d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe