Analysis
- max time kernel
173s - max time network
183s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
20/12/2023, 16:06
General
- Target e23504a2758409735985e9d63e6406c1.exe
- Size 1.7MB
- Sample231220-tkdj8shhd4
- SHA256 fb5ae07416c69f39688e9a1caf6878e1df8ebfa0f99f9083f5961584813ae609
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7NC
Botnet
-
NYAN CAT
C2
-
milla.publicvm.com:5050
Mutex
-
dabd698cf62
Attributes
-
reg_key
dabd698cf62
-
splitter
@!#&^%$
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e23504a2758409735985e9d63e6406c1.exe"C:\Users\Admin\AppData\Local\Temp\e23504a2758409735985e9d63e6406c1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2888-0-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/2888-1-0x0000000000C90000-0x0000000000E4A000-memory.dmp
memory/2888-2-0x0000000005930000-0x00000000059CC000-memory.dmp
memory/2888-3-0x0000000005F80000-0x0000000006524000-memory.dmp
memory/2888-4-0x00000000059D0000-0x0000000005A62000-memory.dmp
memory/2888-5-0x00000000058B0000-0x00000000058C0000-memory.dmp
memory/2888-6-0x00000000058F0000-0x00000000058FA000-memory.dmp
memory/2888-7-0x0000000005900000-0x000000000590C000-memory.dmp
memory/2888-8-0x00000000747D0000-0x0000000074F80000-memory.dmp
memory/2888-9-0x00000000058B0000-0x00000000058C0000-memory.dmp