Analysis
- max time kernel
149s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/02/2024, 22:03
General
- Target a67af2d4ccb73e4a9d50d4474825618626c3a48b76c57bbcc0c510f6e67c660a.exe
- Size 8.2MB
- Sample240226-1yrgkshc88
- SHA256 a67af2d4ccb73e4a9d50d4474825618626c3a48b76c57bbcc0c510f6e67c660a
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7NC
Botnet
-
NYAN CAT
C2
-
milla.publicvm.com:5050
Mutex
-
640f13b0dc0841a9ac5
Attributes
-
reg_key
640f13b0dc0841a9ac5
-
splitter
@!#&^%$
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a67af2d4ccb73e4a9d50d4474825618626c3a48b76c57bbcc0c510f6e67c660a.exe"C:\Users\Admin\AppData\Local\Temp\a67af2d4ccb73e4a9d50d4474825618626c3a48b76c57bbcc0c510f6e67c660a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4512-0-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/4512-1-0x0000000000070000-0x00000000008AA000-memory.dmp
memory/4512-2-0x0000000005880000-0x0000000005E24000-memory.dmp
memory/4512-3-0x00000000052D0000-0x0000000005362000-memory.dmp
memory/4512-4-0x0000000005370000-0x000000000540C000-memory.dmp
memory/4512-5-0x0000000005240000-0x0000000005250000-memory.dmp
memory/4512-6-0x0000000006460000-0x000000000646A000-memory.dmp
memory/4512-7-0x0000000006470000-0x000000000647C000-memory.dmp
memory/4512-8-0x00000000750E0000-0x0000000075890000-memory.dmp
memory/4512-9-0x0000000005240000-0x0000000005250000-memory.dmp