Analysis
-
max time kernel
148s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 18:02
Static task
static1
Behavioral task
behavioral1
Sample
ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe
Resource
win7-20221111-en
windows7-x64
2 signatures
150 seconds
General
-
Target
ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe
-
Size
39KB
-
MD5
03c17cd324c91795ca89512725b6cae9
-
SHA1
2a6b057e8eb399552d7bd61858794fd08f97bcc8
-
SHA256
ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c
-
SHA512
c9f31b717e202b85d3b36a99d96999eb20ad176636875bc9b8dbd199a5c6cc1a5a93466df7917907c6054fed2376f708a76c9b67a9c3d247175b72e36b69640b
-
SSDEEP
768:t2YDGq2S5XOhefd5QahgaTSpZx2neS0Oj2yGlNeO0LR8+wJTpfSvTU:UYiZhe15Xh1TSpb2neSHsNeXLRDw2bU
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
B HAT
Mutex
1fcb8fb3a4794ae29f1b8ef01d138a35
Attributes
-
reg_key
1fcb8fb3a4794ae29f1b8ef01d138a35
-
splitter
|'|'|
Signatures
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exedescription pid process Token: SeDebugPrivilege 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: 33 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: SeIncBasePriorityPrivilege 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: 33 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: SeIncBasePriorityPrivilege 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: 33 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: SeIncBasePriorityPrivilege 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: 33 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: SeIncBasePriorityPrivilege 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: 33 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: SeIncBasePriorityPrivilege 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: 33 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: SeIncBasePriorityPrivilege 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: 33 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: SeIncBasePriorityPrivilege 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: 33 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe Token: SeIncBasePriorityPrivilege 1232 ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe