njrat | 1dab360111d8a0f59674bc5c725b88edac598dd7e0171ab7c3bc5416d45e6e89 | Triage

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 09:16

Sharing

Report Analysis Logs

General

Target

7cbc3b6a36f71c584b08fac91478f033.exe
Size

22KB
MD5

7cbc3b6a36f71c584b08fac91478f033
SHA1

e1b3fc39592cc02aa8b40487c827bc96fb3c830d
SHA256

1dab360111d8a0f59674bc5c725b88edac598dd7e0171ab7c3bc5416d45e6e89
SHA512

f85e4344be0cf30ee9d00e754dcbccfb2bd0833fb16a0a9423388fe2020981e46c20323c385f6be96e0fa52af06b859a65fc006762bd9f2f89062fb7ae180c41
SSDEEP

384:0HVGj4DnU+P24h/WHuvZVofpML+m9tTdcF/Q34Zo2STD6:0iEKuvZzdty40H

Score

10^/10

njrat gold trojan

Malware Config

Extracted

Family

njrat

Version

20

Botnet

gold

C2

149.248.52.61:87

Mutex

165d6ed988ac

Attributes

reg_key
165d6ed988ac
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

7cbc3b6a36f71c584b08fac91478f033.exe

description	pid	process
Token: SeDebugPrivilege	2040	7cbc3b6a36f71c584b08fac91478f033.exe
Token: 33	2040	7cbc3b6a36f71c584b08fac91478f033.exe
Token: SeIncBasePriorityPrivilege	2040	7cbc3b6a36f71c584b08fac91478f033.exe

C:\Users\Admin\AppData\Local\Temp\7cbc3b6a36f71c584b08fac91478f033.exe
"C:\Users\Admin\AppData\Local\Temp\7cbc3b6a36f71c584b08fac91478f033.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x0000000000D10000-0x0000000000D1C000-memory.dmp

Filesize
48KB

Download
memory/2040-1-0x0000000074D10000-0x00000000753FE000-memory.dmp

Filesize
6.9MB

Download
memory/2040-2-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/2040-3-0x0000000074D10000-0x00000000753FE000-memory.dmp

Filesize
6.9MB

Download