njrat | 455447fa7ae0679c65e64f780ae8bc37f464e08f32e78546661c7f102f3b9ac8

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
868695f8a12c6df952f83755e8eb93f7.exe
Size 3.9MB
Sample240201-lda7jabbcp
SHA256 455447fa7ae0679c65e64f780ae8bc37f464e08f32e78546661c7f102f3b9ac8
MD5 868695f8a12c6df952f83755e8eb93f7
SHA1 b63a31c7a39910bc1c95fb0e6e55b23bb5289a44
SHA512 9d2d906e67d7ad7a7e2e84d0551b4f4762d31cc2dce3768ac67297938ceb3b4becfb604087a49939f22321de6af0c0514040de81ff82c53af9060499d132ae5f
SSDEEP 49152:AYWl1jcCghNKBBS2n3s7eBv36yzjFncGtCvMe95aYK/uVJCJRiiDF:A9AcBBDNYyHFnTw95pGu4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

6.tcp.ngrok.io:12440

Mutex

66c22f26035c9d163c535f1acb5d6101

Attributes

reg_key
66c22f26035c9d163c535f1acb5d6101
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
1512	server.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3740 set thread context of 1416	3740	868695f8a12c6df952f83755e8eb93f7.exe	53

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	868695f8a12c6df952f83755e8eb93f7.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 1416	3740	868695f8a12c6df952f83755e8eb93f7.exe	53
PID 3740 wrote to memory of 1416	3740	868695f8a12c6df952f83755e8eb93f7.exe	53
PID 3740 wrote to memory of 1416	3740	868695f8a12c6df952f83755e8eb93f7.exe	53
PID 3740 wrote to memory of 1416	3740	868695f8a12c6df952f83755e8eb93f7.exe	53
PID 3740 wrote to memory of 1416	3740	868695f8a12c6df952f83755e8eb93f7.exe	53
PID 3740 wrote to memory of 1416	3740	868695f8a12c6df952f83755e8eb93f7.exe	53
PID 3740 wrote to memory of 1416	3740	868695f8a12c6df952f83755e8eb93f7.exe	53
PID 3740 wrote to memory of 1416	3740	868695f8a12c6df952f83755e8eb93f7.exe	53
PID 1416 wrote to memory of 1512	1416	aspnet_compiler.exe	95
PID 1416 wrote to memory of 1512	1416	aspnet_compiler.exe	95
PID 1416 wrote to memory of 1512	1416	aspnet_compiler.exe	95

C:\Users\Admin\AppData\Local\Temp\868695f8a12c6df952f83755e8eb93f7.exe
"C:\Users\Admin\AppData\Local\Temp\868695f8a12c6df952f83755e8eb93f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  #cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Executes dropped EXE
    PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 55KB
SHA256 99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09
MD5 fda8c8f2a4e100afb14c13dfcbcab2d2
SHA1 19dfd86294c4a525ba21c6af77681b2a9bbecb55
SHA512 94f0ace37cae77be9935cf4fc8aaa94691343d3b38de5e16c663b902c220bff513cd02256c7af2d815a23dd30439582ddbb0880009c76bbf36ff8fbc1a6ddc18
SSDEEP 768:fF9E8FLLs2Zokf85d9PTV6Iq8Fnqf7P+WxqWKnz8DH:ffE6EkfOd9PT86dWvKgb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1416-21-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/1416-5-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1416-9-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/1416-8-0x00000000050D0000-0x000000000516C000-memory.dmp

Download

memory/1512-27-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/1512-24-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/1512-25-0x0000000005410000-0x000000000593C000-memory.dmp

Download

memory/1512-23-0x00000000006D0000-0x00000000006E0000-memory.dmp

Download

memory/3740-3-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/3740-7-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/3740-4-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/3740-1-0x00000000007D0000-0x0000000000BC0000-memory.dmp

Download

memory/3740-2-0x0000000007D30000-0x00000000082D4000-memory.dmp

Download

memory/3740-0-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads