Analysis
- max time kernel
440s - max time network
1166s - platform
windows11-21h2_x64 - resource
win11-20231215-en - resource tags
- submitted
28/01/2024, 01:47
General
- Target chromelulz.exe
- Size 25KB
- Sample240128-b7msbagha3
- SHA256 bb7ede5a2cff1bdbab9330a40cf3d44d7bfac7e1ec2675a7232b8b6702a9330d
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
lulz
C2
-
/0.tcp.us-cal-1.ngrok.io:9000
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\chromelulz.exe"C:\Users\Admin\AppData\Local\Temp\chromelulz.exe"1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1064-1-0x000000001C330000-0x000000001C7FE000-memory.dmp
memory/1064-0-0x00007FFC9F100000-0x00007FFC9FAA1000-memory.dmp
memory/1064-2-0x0000000001810000-0x0000000001822000-memory.dmp
memory/1064-4-0x00007FFC9F100000-0x00007FFC9FAA1000-memory.dmp
memory/1064-3-0x000000001C8C0000-0x000000001C966000-memory.dmp
memory/1064-5-0x0000000001880000-0x0000000001890000-memory.dmp
memory/1064-6-0x000000001CC80000-0x000000001CD1C000-memory.dmp
memory/1064-10-0x00007FFC9F100000-0x00007FFC9FAA1000-memory.dmp