njrat | a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2

max time kernel
149s
max time network
149s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22-05-2024 18:07

Sharing

Target

Server.exe
Size

43KB
MD5

49ad4c0475749e6dd6001f5a038ab6a8
SHA1

4e31ba96d944bb61c65e459153f5762ebde54338
SHA256

a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2
SHA512

4304e871c505b2a0bf6a12292ac50e7c6665c6b73138f6501f3c091a5bc2d41c6237c6a019a03530d451bb7b35241c89ac71478c283af2ee57e488fb55bca087
SSDEEP

384:tbZyjJ61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnXmgreT:/0Qk4smKS3OR9Z0OuXQ/o6C+L

Score

10^/10

njrat hacked trojan

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

19.ip.gl.ply.gg:60143

Mutex

Windows Update

Attributes

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Server.exe

pid process

2796 Server.exe

pid	process
2796	Server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe
Token: 33	2796	Server.exe
Token: SeIncBasePriorityPrivilege	2796	Server.exe

memory/2796-0-0x0000000073D9E000-0x0000000073D9F000-memory.dmp

Filesize
4KB

Download
memory/2796-1-0x0000000000E30000-0x0000000000E42000-memory.dmp

Filesize
72KB

Download
memory/2796-2-0x00000000057B0000-0x000000000584C000-memory.dmp

Filesize
624KB

Download
memory/2796-3-0x0000000005F90000-0x000000000648E000-memory.dmp

Filesize
5.0MB

Download
memory/2796-4-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2796-5-0x0000000005BB0000-0x0000000005C42000-memory.dmp

Filesize
584KB

Download
memory/2796-6-0x0000000005B90000-0x0000000005B9A000-memory.dmp

Filesize
40KB

Download
memory/2796-7-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/2796-8-0x0000000006AE0000-0x0000000006AF8000-memory.dmp

Filesize
96KB

Download
memory/2796-9-0x0000000073D9E000-0x0000000073D9F000-memory.dmp

Filesize
4KB

Download
memory/2796-10-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2796-11-0x00000000012E0000-0x00000000012EE000-memory.dmp

Filesize
56KB

Download
memory/2796-12-0x0000000001630000-0x0000000001652000-memory.dmp

Filesize
136KB

Download