Analysis
-
max time kernel
120s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
30/10/2023, 16:41
General
-
Target
njRATs/njRAT v0.7 versions/njRAT 0.7D Green Edition/NjRat 0.7D Green Edition by im523.exe
-
Size
1.6MB
-
MD5
1033c448810d3b507423546432e2f502
-
SHA1
2bf9d04f68ed15b957378fb95daa78c85d5b2b26
-
SHA256
f0c85722b88d1e7a1941ba17551cd5c29aef99fad86d78a5631a0f5446b3f580
-
SHA512
aeb964632dfad41fc383a68ace0e6beb152a7075f21a32e449624a27da5d2a5ccda0665fbd90597d65d74b0790877baf6f81336660b1df4bf38b41cd0bc6cd44
-
SSDEEP
12288:ouicuiPszLSDeMFFFFFFFNPjiRfbljmYpNk1Yt6JwpwqVcTeec7neIjjpL:ouicui0zLSDRPjiRfzUcpcNgD
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\njRATs\njRAT v0.7 versions\njRAT 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe"C:\Users\Admin\AppData\Local\Temp\njRATs\njRAT v0.7 versions\njRAT 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 17122⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xd81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB