Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 05:47
Behavioral task
behavioral1
Sample
2a95b8bcfbd5b21dd97e06494d6adf20.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
General
-
Target
2a95b8bcfbd5b21dd97e06494d6adf20.exe
-
Size
22KB
-
MD5
2a95b8bcfbd5b21dd97e06494d6adf20
-
SHA1
403143d1914e3220c026e4a00feff8fd33060497
-
SHA256
8e3f04d34dfb35e685f6785c406ab5ffdad15ba376c8ac584bf25c7a7b3b547a
-
SHA512
b47db73b3f05fe42ceeb3729c6f593dbd5fcee2b4aec5277ca833fb0fa878f25fdcf8bbc99c4ad87eb971a5df388d202f99a1873fee0b45f5319a61b8dc8544d
-
SSDEEP
384:nHVGj4DnU+P24h/WHuvZVoCk+NdcF//34Zo6JSTTc31:niEKuvZfk+wH0px31
Malware Config
Extracted
Family
njrat
Version
20
Botnet
gold
C2
149.248.52.61:87
Mutex
165d6ed988ac
Attributes
-
reg_key
165d6ed988ac
-
splitter
|'|'|
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2a95b8bcfbd5b21dd97e06494d6adf20.exedescription pid process Token: SeDebugPrivilege 2252 2a95b8bcfbd5b21dd97e06494d6adf20.exe Token: 33 2252 2a95b8bcfbd5b21dd97e06494d6adf20.exe Token: SeIncBasePriorityPrivilege 2252 2a95b8bcfbd5b21dd97e06494d6adf20.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2252-0-0x0000000001230000-0x000000000123C000-memory.dmpFilesize
48KB
-
memory/2252-1-0x0000000074570000-0x0000000074C5E000-memory.dmpFilesize
6.9MB
-
memory/2252-2-0x0000000004BE0000-0x0000000004C20000-memory.dmpFilesize
256KB
-
memory/2252-3-0x0000000074570000-0x0000000074C5E000-memory.dmpFilesize
6.9MB
-
memory/2252-4-0x0000000004BE0000-0x0000000004C20000-memory.dmpFilesize
256KB