Resubmissions
22/05/2024, 18:16
240522-wweyjsbe8v1022/05/2024, 18:15
240522-wwchesbe7y1022/05/2024, 18:11
240522-wslxpabd6s1022/05/2024, 18:10
240522-wsfqnsbe441022/05/2024, 18:10
240522-wsdajsbe391022/05/2024, 18:10
240522-wr9mcsbd5w1022/05/2024, 18:10
240522-wr668sbe321022/05/2024, 18:10
240522-wr35ksbe271022/05/2024, 18:08
240522-wq26wsbd641022/05/2024, 18:08
240522-wqx7yabd5710Analysis
- max time kernel
1799s - max time network
1795s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
22/05/2024, 18:10
Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral3
Sample
Server.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
1800 seconds
General
- Target Server.exe
- Size 43KB
- Sample240522-wr9mcsbd5w
- SHA256 a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2
- MD5 49ad4c0475749e6dd6001f5a038ab6a8
- SHA1 4e31ba96d944bb61c65e459153f5762ebde54338
- SHA512 4304e871c505b2a0bf6a12292ac50e7c6665c6b73138f6501f3c091a5bc2d41c6237c6a019a03530d451bb7b35241c89ac71478c283af2ee57e488fb55bca087
- SSDEEP 384:tbZyjJ61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnXmgreT:/0Qk4smKS3OR9Z0OuXQ/o6C+L
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
HacKed
C2
-
19.ip.gl.ply.gg:60143
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3484 Server.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe Token: SeIncBasePriorityPrivilege 3484 Server.exe Token: 33 3484 Server.exe