njrat | 832c8490c1641d7d3f1597e7d6b95cc21d018e45a8258d1a23ac184b9ec506f4

Analysis

max time kernel
129s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-05-2023 01:01

Target

644e22017e7ea1528dca300ff5efc8a07f8587b3b15ea079ea0b9b205b0b4d83.exe
Size

431KB
MD5

0ec8c3c2398d384e8f53ce811a488b49
SHA1

6de36a097b8d734bf242a22efb0f64fc433b87cb
SHA256

644e22017e7ea1528dca300ff5efc8a07f8587b3b15ea079ea0b9b205b0b4d83
SHA512

f100b7b7e5306be27f084c1347a285998b5bba1d8872167e3632797a6d6c0f94803152f56be29ee89a3a9f74da0dc5f984d14eccfd9eeb7804051a5e4999589b
SSDEEP

6144:GvuswBr11L2Ji69aOZjYqnKhTuo7Ebr9bH30+lDPt:GvuxnOo4brxH30iDPt

Score

10^/10

njrat trojan

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
108	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 108	1072	644e22017e7ea1528dca300ff5efc8a07f8587b3b15ea079ea0b9b205b0b4d83.exe	28
PID 1072 wrote to memory of 108	1072	644e22017e7ea1528dca300ff5efc8a07f8587b3b15ea079ea0b9b205b0b4d83.exe	28
PID 1072 wrote to memory of 108	1072	644e22017e7ea1528dca300ff5efc8a07f8587b3b15ea079ea0b9b205b0b4d83.exe	28

C:\Users\Admin\AppData\Local\Temp\644e22017e7ea1528dca300ff5efc8a07f8587b3b15ea079ea0b9b205b0b4d83.exe
"C:\Users\Admin\AppData\Local\Temp\644e22017e7ea1528dca300ff5efc8a07f8587b3b15ea079ea0b9b205b0b4d83.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 496
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:108

memory/108-58-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/1072-54-0x00000000002D0000-0x0000000000342000-memory.dmp

Filesize
456KB

Download
memory/1072-55-0x0000000001FA0000-0x0000000002020000-memory.dmp

Filesize
512KB

Download
memory/1072-56-0x0000000001FA0000-0x0000000002020000-memory.dmp

Filesize
512KB

Download
memory/1072-57-0x0000000001FA0000-0x0000000002020000-memory.dmp

Filesize
512KB

Download
memory/1072-59-0x0000000001FA0000-0x0000000002020000-memory.dmp

Filesize
512KB

Download
memory/1072-60-0x0000000001FA0000-0x0000000002020000-memory.dmp

Filesize
512KB

Download