njrat | e7ae497afab39d1799e228532ded33ea74ec4a6bf8c79964a7d0f557c7264fb4

Analysis

max time kernel
148s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/06/2023, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 43KB
Sample230609-bgmpmaaf36
SHA256 e7ae497afab39d1799e228532ded33ea74ec4a6bf8c79964a7d0f557c7264fb4
MD5 e33dafb811a56b8295d2cfb4cac645c1
SHA1 8d93eb10381a824464b4324a62735e4ec96393a4
SHA512 bdb7d514aaf37ae27bc0f8e5d098fd1bde97a7e7ca1c0d5388dcb5c592f07e6ace5470100492a87223414dada4bdcd0db1875744565d199b54efff2496aa0b4f
SSDEEP 384:rZy54oi98Na5yCSh1zWHjREYbul60kzsIij+ZsNO3PlpJKkkjh/TzF7pWnSSmgrq:FEiywwCQtg7WEuXQ/osC+L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

HowToLive913-31335.portmap.host:31335

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1292	file.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe
Token: 33	1292	file.exe
Token: SeIncBasePriorityPrivilege	1292	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-54-0x0000000000120000-0x0000000000132000-memory.dmp

Download

memory/1292-55-0x0000000004B90000-0x0000000004BD0000-memory.dmp