Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
03/08/2023, 01:51
General
-
Target
38e159243e451831d58f191bf027f88c.exe
-
Size
43KB
-
MD5
38e159243e451831d58f191bf027f88c
-
SHA1
533798da369c405a347a59a21062e75f31ca3065
-
SHA256
3bc719432f503c057762d2de93c2598f0cd5c086e68e1f804f9035caa67d2a74
-
SHA512
5da370fcd192567c452c0f5c102d1299939ede64bddf2a217c0cfc1c92f05c1463fb03a7824ba98c4c48530049c07903be314d4f4c2ae482b75f6735a2a2f3d1
-
SSDEEP
384:N8ZybjqyCEFmVoyb37ilaY2EdizMgh+zEIij+ZsNO3PlpJKkkjh/TzF7pWnOmgrq:N6yjqyVAVlbLCHKQgWuXQ/oXC+L
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
0.tcp.eu.ngrok.io:18953
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e159243e451831d58f191bf027f88c.exe"C:\Users\Admin\AppData\Local\Temp\38e159243e451831d58f191bf027f88c.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
64KB