Analysis
-
max time kernel
147s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12/01/2024, 10:56
General
-
Target
56442e09f109c9240e38f447d3353026.exe
-
Size
449KB
-
MD5
56442e09f109c9240e38f447d3353026
-
SHA1
6957c1043784a2e7550cc15c5ed7c03977cc696a
-
SHA256
c2d9651404820b7dbea6d3cc78b8795f342bb7b176575b9915b2460e70bd0498
-
SHA512
689917322d15103cfe95123e7a00b82a5f83600f3d8c87adfd984b635fcaec5937279f14fafec0e51f599a37027137e340ffaca2b131abb477ea06a6860d0907
-
SSDEEP
12288:2yNr36BagStoIzQ1Qlrffjeuk+w2PaZghYzY:2yNz6B9QzQ10fZwewghYzY
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
127.0.0.1:5554
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies registry class 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56442e09f109c9240e38f447d3353026.exe"C:\Users\Admin\AppData\Local\Temp\56442e09f109c9240e38f447d3353026.exe"1⤵
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB