Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 21:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
97a0eb57238595a3e8098174f540f838.exe
Resource
win7-20231215-en
2 signatures
150 seconds
General
-
Target
97a0eb57238595a3e8098174f540f838.exe
-
Size
92KB
-
MD5
97a0eb57238595a3e8098174f540f838
-
SHA1
f30814f173ff1b7fda2f80a9c3147c6cebc69015
-
SHA256
ec19b1eba196b2f786419af500ded217741d352bf0c6f025a802a907e24f00da
-
SHA512
61669b01fe073f44c39b49912013c04ff5a39f8acd39d413a8307659d5522d2ead7c2d0db50c1fa1a3766fb38dbe179a8ad40f6c569b510112c9fa0cf579e575
-
SSDEEP
768:FrrqBpvCwvadPiLYbz+GG/RoHzygsT1qBmCJyqYseZ1dVnhJdVei47BDFMGi:NWpqwydPiLwg4K1VED5i
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
127.0.0.1:4455
Mutex
bd96744cd1
Attributes
-
reg_key
bd96744cd1
-
splitter
@!#&^%$
Signatures
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
97a0eb57238595a3e8098174f540f838.exedescription pid process Token: SeDebugPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe Token: 33 1916 97a0eb57238595a3e8098174f540f838.exe Token: SeIncBasePriorityPrivilege 1916 97a0eb57238595a3e8098174f540f838.exe