njrat | e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367

Analysis

max time kernel
7s
max time network
41s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
06-12-2023 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367.exe
Size

43KB
MD5

1e28904cacc4be6d50c03fb71171d9a7
SHA1

1915e4f915e7e06df9efe1619921ae7960f1cbb2
SHA256

e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367
SHA512

5d3ac9e12ad81ea89d62717ebc65d9a1f9dab173b956741070cca4c551c675e6c91918928835817b8b082632e5f4d7d98e64949d54b8404188983efc044f3df0
SSDEEP

384:CZy7polQ5GoyyNrl3cXmICEDXH/zIIij+ZsNO3PlpJKkkjh/TzF7pWnZ/greT0pO:wBmolyNrB4LRxuXQ/o0/+L

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

0.tcp.eu.ngrok.io:15505

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367.exe

pid process

2880 e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367.exe

pid	process
2880	e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367.exe

C:\Users\Admin\AppData\Local\Temp\e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367.exe
"C:\Users\Admin\AppData\Local\Temp\e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2880

C:\Users\Admin\AppData\Roaming\Dllhost.exe
"C:\Users\Admin\AppData\Roaming\Dllhost.exe"
2⤵
PID:2276

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Dllhost.exe
Filesize
43KB

MD5
1e28904cacc4be6d50c03fb71171d9a7

SHA1
1915e4f915e7e06df9efe1619921ae7960f1cbb2

SHA256
e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367

SHA512
5d3ac9e12ad81ea89d62717ebc65d9a1f9dab173b956741070cca4c551c675e6c91918928835817b8b082632e5f4d7d98e64949d54b8404188983efc044f3df0

Download Submit
C:\Users\Admin\AppData\Roaming\Dllhost.exe
Filesize
43KB

MD5
1e28904cacc4be6d50c03fb71171d9a7

SHA1
1915e4f915e7e06df9efe1619921ae7960f1cbb2

SHA256
e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367

SHA512
5d3ac9e12ad81ea89d62717ebc65d9a1f9dab173b956741070cca4c551c675e6c91918928835817b8b082632e5f4d7d98e64949d54b8404188983efc044f3df0

Download Submit
\Users\Admin\AppData\Roaming\Dllhost.exe
Filesize
43KB

MD5
1e28904cacc4be6d50c03fb71171d9a7

SHA1
1915e4f915e7e06df9efe1619921ae7960f1cbb2

SHA256
e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367

SHA512
5d3ac9e12ad81ea89d62717ebc65d9a1f9dab173b956741070cca4c551c675e6c91918928835817b8b082632e5f4d7d98e64949d54b8404188983efc044f3df0

Download Submit
memory/2276-11-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2276-13-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2276-10-0x0000000000BF0000-0x0000000000C02000-memory.dmp

Filesize
72KB

Download
memory/2880-0-0x0000000000B30000-0x0000000000B42000-memory.dmp

Filesize
72KB

Download
memory/2880-1-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2880-2-0x0000000004750000-0x0000000004790000-memory.dmp

Filesize
256KB

Download
memory/2880-12-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download