Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
25-05-2024 06:39
General
-
Target
d9f2b22eda3441624144b5867d8127cd568653da889a4aac1f8d5e655f8e8691.exe
-
Size
43KB
-
MD5
5f77b2c53a3b561eda6eeb02a213d01e
-
SHA1
97db553bd691c1d868e88a00ac2a38f923ad2ae0
-
SHA256
d9f2b22eda3441624144b5867d8127cd568653da889a4aac1f8d5e655f8e8691
-
SHA512
67ab2df1a139d6b53af0c5977ad637bcb201dca2715fc2d55ed497fed5f6a548dc716f29fb57cb9ef72f1e47f7680c30750e591ac1ea07ec016f802a6aa93578
-
SSDEEP
768:Y5fRtsYZGKbEaG1AUpuzf/uuXQ/omzuC+L:Y5fRtsQbEaG1AUMzf/uuXQQmzuCM
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
these-accommodation.gl.at.ply.gg:39657
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9f2b22eda3441624144b5867d8127cd568653da889a4aac1f8d5e655f8e8691.exe"C:\Users\Admin\AppData\Local\Temp\d9f2b22eda3441624144b5867d8127cd568653da889a4aac1f8d5e655f8e8691.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB