njrat | a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:08

Sharing

Target

Server.exe
Size

43KB
MD5

49ad4c0475749e6dd6001f5a038ab6a8
SHA1

4e31ba96d944bb61c65e459153f5762ebde54338
SHA256

a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2
SHA512

4304e871c505b2a0bf6a12292ac50e7c6665c6b73138f6501f3c091a5bc2d41c6237c6a019a03530d451bb7b35241c89ac71478c283af2ee57e488fb55bca087
SSDEEP

384:tbZyjJ61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnXmgreT:/0Qk4smKS3OR9Z0OuXQ/o6C+L

Score

10^/10

njrat hacked trojan

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

19.ip.gl.ply.gg:60143

Mutex

Windows Update

Attributes

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Server.exe

pid process

1148 Server.exe

pid	process
1148	Server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe
Token: 33	1148	Server.exe
Token: SeIncBasePriorityPrivilege	1148	Server.exe

memory/1148-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Filesize
4KB

Download
memory/1148-1-0x00000000008F0000-0x0000000000902000-memory.dmp

Filesize
72KB

Download
memory/1148-2-0x00000000052E0000-0x000000000537C000-memory.dmp

Filesize
624KB

Download
memory/1148-3-0x0000000005B40000-0x00000000060E4000-memory.dmp

Filesize
5.6MB

Download
memory/1148-4-0x00000000056E0000-0x0000000005772000-memory.dmp

Filesize
584KB

Download
memory/1148-5-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/1148-6-0x00000000056C0000-0x00000000056CA000-memory.dmp

Filesize
40KB

Download
memory/1148-7-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download
memory/1148-8-0x0000000006740000-0x0000000006758000-memory.dmp

Filesize
96KB

Download
memory/1148-9-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Filesize
4KB

Download
memory/1148-10-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download