njrat | c799715ebecae40dd71426a872ce0ea42cf73acedcdff88f68a77eb6f51653b5

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44e43333da812231443907015441c3b3.ps1
Size 42KB
Sample240106-bgna6afae5
SHA256 c799715ebecae40dd71426a872ce0ea42cf73acedcdff88f68a77eb6f51653b5
MD5 44e43333da812231443907015441c3b3
SHA1 524ef19d280a95fc26c68cf6d983633bf6a3770e
SHA512 9b9ab9bf95cceacee4598079f99f5651ebf16de7524d2a714bbdd2a3626418e66a6b76827f322380a1154c0830b9c803b778902a9b992bf696b8db4c0935a7b8
SSDEEP 384:EX9d2LzuIJ3VO5sacPGWXgNQN99ser3l6gmH1Et/yvpFM/XW1etLumlCObF8qrrz:nHuItAaacP7Nfl6gJV6pm/XrTbaqraQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat nyan cat trojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

cyberfam.ddns.net:8888

Mutex

9e1f9aae58444

Attributes

reg_key
9e1f9aae58444
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3580	powershell.exe
3580	powershell.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe
Token: 33	3580	powershell.exe
Token: SeIncBasePriorityPrivilege	3580	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\44e43333da812231443907015441c3b3.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ejxtlk4t.f2l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ejxtlk4t.f2l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3580-9-0x00000270245C0000-0x00000270245E2000-memory.dmp

Download

memory/3580-10-0x00007FFB4AC00000-0x00007FFB4B6C1000-memory.dmp

Download

memory/3580-11-0x0000027024300000-0x0000027024310000-memory.dmp

Download

memory/3580-12-0x0000027024300000-0x0000027024310000-memory.dmp

Download

memory/3580-13-0x00000270247F0000-0x00000270247FC000-memory.dmp

Download

memory/3580-14-0x00007FFB4AC00000-0x00007FFB4B6C1000-memory.dmp

Download

memory/3580-15-0x0000027024300000-0x0000027024310000-memory.dmp

Download

memory/3580-16-0x0000027024300000-0x0000027024310000-memory.dmp

Download