njrat | a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2

max time kernel
149s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22-05-2024 18:07

Sharing

Target

Server.exe
Size

43KB
MD5

49ad4c0475749e6dd6001f5a038ab6a8
SHA1

4e31ba96d944bb61c65e459153f5762ebde54338
SHA256

a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2
SHA512

4304e871c505b2a0bf6a12292ac50e7c6665c6b73138f6501f3c091a5bc2d41c6237c6a019a03530d451bb7b35241c89ac71478c283af2ee57e488fb55bca087
SSDEEP

384:tbZyjJ61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnXmgreT:/0Qk4smKS3OR9Z0OuXQ/o6C+L

Score

10^/10

njrat hacked trojan

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

19.ip.gl.ply.gg:60143

Mutex

Windows Update

Attributes

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Server.exe

pid process

2768 Server.exe

pid	process
2768	Server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe
Token: 33	2768	Server.exe
Token: SeIncBasePriorityPrivilege	2768	Server.exe

memory/2768-0-0x000000007399E000-0x000000007399F000-memory.dmp

Filesize
4KB

Download
memory/2768-1-0x0000000000FA0000-0x0000000000FB2000-memory.dmp

Filesize
72KB

Download
memory/2768-2-0x00000000057B0000-0x000000000584C000-memory.dmp

Filesize
624KB

Download
memory/2768-3-0x0000000005FE0000-0x00000000064DE000-memory.dmp

Filesize
5.0MB

Download
memory/2768-4-0x0000000005BE0000-0x0000000005C72000-memory.dmp

Filesize
584KB

Download
memory/2768-5-0x0000000073990000-0x000000007407E000-memory.dmp

Filesize
6.9MB

Download
memory/2768-6-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

Filesize
40KB

Download
memory/2768-7-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Filesize
408KB

Download
memory/2768-8-0x0000000006C60000-0x0000000006C78000-memory.dmp

Filesize
96KB

Download
memory/2768-9-0x000000007399E000-0x000000007399F000-memory.dmp

Filesize
4KB

Download
memory/2768-10-0x0000000073990000-0x000000007407E000-memory.dmp

Filesize
6.9MB

Download