njrat | a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2

max time kernel
1799s
max time network
1795s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22-05-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

43KB
MD5

49ad4c0475749e6dd6001f5a038ab6a8
SHA1

4e31ba96d944bb61c65e459153f5762ebde54338
SHA256

a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2
SHA512

4304e871c505b2a0bf6a12292ac50e7c6665c6b73138f6501f3c091a5bc2d41c6237c6a019a03530d451bb7b35241c89ac71478c283af2ee57e488fb55bca087
SSDEEP

384:tbZyjJ61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnXmgreT:/0Qk4smKS3OR9Z0OuXQ/o6C+L

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

19.ip.gl.ply.gg:60143

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Server.exe

pid process

4684 Server.exe

pid	process
4684	Server.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe
Token: SeIncBasePriorityPrivilege	4684	Server.exe
Token: 33	4684	Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4684-0-0x0000000073CAE000-0x0000000073CAF000-memory.dmp

Filesize
4KB

Download
memory/4684-1-0x0000000000BF0000-0x0000000000C02000-memory.dmp

Filesize
72KB

Download
memory/4684-2-0x00000000054C0000-0x000000000555C000-memory.dmp

Filesize
624KB

Download
memory/4684-3-0x0000000005D90000-0x000000000628E000-memory.dmp

Filesize
5.0MB

Download
memory/4684-4-0x0000000073CA0000-0x000000007438E000-memory.dmp

Filesize
6.9MB

Download
memory/4684-5-0x0000000005890000-0x0000000005922000-memory.dmp

Filesize
584KB

Download
memory/4684-6-0x0000000005700000-0x000000000570A000-memory.dmp

Filesize
40KB

Download
memory/4684-7-0x0000000073CA0000-0x000000007438E000-memory.dmp

Filesize
6.9MB

Download