njrat | 5b47de608358f60bf4f6beea0c0b57a9225805d7c251dada35473c59a5bd3cb2

Analysis

max time kernel
165s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fc8c41954bae191a8f44a29c9aab325.exe
Size

8.4MB
MD5

0fc8c41954bae191a8f44a29c9aab325
SHA1

e8dc3fc2f74d397e458ac40adf9ecfc37b8abf69
SHA256

5b47de608358f60bf4f6beea0c0b57a9225805d7c251dada35473c59a5bd3cb2
SHA512

c73f4c2204da91fbf7910cb0136651ad74b0a9c83b1b39e721db0f348476cac97189a06d6db06820656414fa5921a029ecba663c68ef3ddf7994c704eafea232
SSDEEP

98304:52rqnq7XlUpRIcerFwSEuXDJfPJ88GSUqyO6cZqYbIZ:5Kqq7qnIcerTfPJtGSUqNhIZ

Score

10^/10

njrat trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4767c0bac9242915822b454412e0d945.exe	0fc8c41954bae191a8f44a29c9aab325.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4767c0bac9242915822b454412e0d945.exe	0fc8c41954bae191a8f44a29c9aab325.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: 33	1888	0fc8c41954bae191a8f44a29c9aab325.exe
Token: SeIncBasePriorityPrivilege	1888	0fc8c41954bae191a8f44a29c9aab325.exe

C:\Users\Admin\AppData\Local\Temp\0fc8c41954bae191a8f44a29c9aab325.exe
"C:\Users\Admin\AppData\Local\Temp\0fc8c41954bae191a8f44a29c9aab325.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-0-0x0000000074A30000-0x0000000074FDB000-memory.dmp

Filesize
5.7MB

Download
memory/1888-1-0x0000000074A30000-0x0000000074FDB000-memory.dmp

Filesize
5.7MB

Download
memory/1888-2-0x00000000005E0000-0x0000000000620000-memory.dmp

Filesize
256KB

Download
memory/1888-4-0x00000000005E0000-0x0000000000620000-memory.dmp

Filesize
256KB

Download
memory/1888-5-0x0000000074A30000-0x0000000074FDB000-memory.dmp

Filesize
5.7MB

Download
memory/1888-6-0x0000000074A30000-0x0000000074FDB000-memory.dmp

Filesize
5.7MB

Download
memory/1888-7-0x00000000005E0000-0x0000000000620000-memory.dmp

Filesize
256KB

Download
memory/1888-8-0x00000000005E0000-0x0000000000620000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads