Analysis
-
max time kernel
146s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 05:47
Behavioral task
behavioral1
Sample
2a95b8bcfbd5b21dd97e06494d6adf20.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
General
-
Target
2a95b8bcfbd5b21dd97e06494d6adf20.exe
-
Size
22KB
-
MD5
2a95b8bcfbd5b21dd97e06494d6adf20
-
SHA1
403143d1914e3220c026e4a00feff8fd33060497
-
SHA256
8e3f04d34dfb35e685f6785c406ab5ffdad15ba376c8ac584bf25c7a7b3b547a
-
SHA512
b47db73b3f05fe42ceeb3729c6f593dbd5fcee2b4aec5277ca833fb0fa878f25fdcf8bbc99c4ad87eb971a5df388d202f99a1873fee0b45f5319a61b8dc8544d
-
SSDEEP
384:nHVGj4DnU+P24h/WHuvZVoCk+NdcF//34Zo6JSTTc31:niEKuvZfk+wH0px31
Malware Config
Extracted
Family
njrat
Version
20
Botnet
gold
C2
149.248.52.61:87
Mutex
165d6ed988ac
Attributes
-
reg_key
165d6ed988ac
-
splitter
|'|'|
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2a95b8bcfbd5b21dd97e06494d6adf20.exedescription pid process Token: SeDebugPrivilege 3168 2a95b8bcfbd5b21dd97e06494d6adf20.exe Token: 33 3168 2a95b8bcfbd5b21dd97e06494d6adf20.exe Token: SeIncBasePriorityPrivilege 3168 2a95b8bcfbd5b21dd97e06494d6adf20.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3168-1-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/3168-0-0x0000000000270000-0x000000000027C000-memory.dmpFilesize
48KB
-
memory/3168-2-0x0000000005250000-0x00000000057F4000-memory.dmpFilesize
5.6MB
-
memory/3168-3-0x0000000004CA0000-0x0000000004D3C000-memory.dmpFilesize
624KB
-
memory/3168-5-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/3168-4-0x0000000004E20000-0x0000000004EB2000-memory.dmpFilesize
584KB
-
memory/3168-6-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/3168-7-0x0000000005240000-0x000000000524A000-memory.dmpFilesize
40KB
-
memory/3168-8-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB