Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 14:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7467ECC03872D65FE8D417967E495CD5.exe
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
7467ECC03872D65FE8D417967E495CD5.exe
-
Size
1.1MB
-
MD5
7467ecc03872d65fe8d417967e495cd5
-
SHA1
c2d13479568363882878cf02b5996feab32ad5b9
-
SHA256
384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5
-
SHA512
4e0a76209ca8249f813f1fdb07438eb04a8e64783c34103d63abd91bc0e7584f3df640dca7982244e939c0b0c223fd3420a9e946c5bc0fa5e25c4fc66ec2152a
-
SSDEEP
24576:1EkcnmDweOrhcpd8xC/VaKEOq/s88sssss8ssPsssssssd:1E9mDB2hs8gAK0/s88sssss8ssPssssk
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
seznam.zapto.org:5050
Mutex
251577ddb354
Attributes
-
reg_key
251577ddb354
-
splitter
@!#&^%$
Signatures
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
7467ECC03872D65FE8D417967E495CD5.exedescription pid process Token: SeDebugPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: 33 2940 7467ECC03872D65FE8D417967E495CD5.exe Token: SeIncBasePriorityPrivilege 2940 7467ECC03872D65FE8D417967E495CD5.exe