Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 04:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe
-
Size
1.1MB
-
MD5
7467ecc03872d65fe8d417967e495cd5
-
SHA1
c2d13479568363882878cf02b5996feab32ad5b9
-
SHA256
384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5
-
SHA512
4e0a76209ca8249f813f1fdb07438eb04a8e64783c34103d63abd91bc0e7584f3df640dca7982244e939c0b0c223fd3420a9e946c5bc0fa5e25c4fc66ec2152a
-
SSDEEP
24576:1EkcnmDweOrhcpd8xC/VaKEOq/s88sssss8ssPsssssssd:1E9mDB2hs8gAK0/s88sssss8ssPssssk
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
seznam.zapto.org:5050
Mutex
251577ddb354
Attributes
-
reg_key
251577ddb354
-
splitter
@!#&^%$
Signatures
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exedescription pid process Token: SeDebugPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: 33 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe Token: SeIncBasePriorityPrivilege 1424 384283583fa482e95a7c30f81b6f3270f7cae4307804943de91bbd728d6c73a5.exe