2ce8cb36ecb4fd1fc004ac64495da7252223753658440fee143f9e6ce4b27d05

Analysis

max time kernel
1565s
max time network
1567s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 10:55

Target

Njrat-main/NjRat 0.7D Green Edition by im523(Beta).exe
Size

1.7MB
MD5

2d3f9951b531061af499f324ca30f3ce
SHA1

090626c1013d4e30c182cddc881ef004b7289ede
SHA256

7914abca942a21058ca87cf2e19366ce41204fa1085008cb890f5853bc852b2d
SHA512

e8ef728be7d9fb55b95b52e0c3e0e87d2a6e560ec5df309878b13c447e349bd2885f5fe1ef4075392bc242523fa7d74aea9607f48194cbc241a39ba04e9b03a5
SSDEEP

49152:1UNixUNihxhA3333333333333QthBKthxeGlPAZwX:iiWijhA3333333333333QthIthxlPAZk

Score

7^/10

Executes dropped EXE 2 IoCs

Processes:

~__UNINST.EXENjRat 0.7D Green Edition by im523.exe

pid process

2056 ~__UNINST.EXE
2832 NjRat 0.7D Green Edition by im523.exe

pid	process
2056	~__UNINST.EXE
2832	NjRat 0.7D Green Edition by im523.exe

Loads dropped DLL 7 IoCs

Processes:

NjRat 0.7D Green Edition by im523(Beta).exe~__UNINST.EXENjRat 0.7D Green Edition by im523.exe

pid	process
2176	NjRat 0.7D Green Edition by im523(Beta).exe
2056	~__UNINST.EXE
2056	~__UNINST.EXE
2056	~__UNINST.EXE
2056	~__UNINST.EXE
2832	NjRat 0.7D Green Edition by im523.exe
2832	NjRat 0.7D Green Edition by im523.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NjRat 0.7D Green Edition by im523.exe

pid process

2832 NjRat 0.7D Green Edition by im523.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

NjRat 0.7D Green Edition by im523.exe

pid process

2832 NjRat 0.7D Green Edition by im523.exe

pid	process
2832	NjRat 0.7D Green Edition by im523.exe

pid	process
2832	NjRat 0.7D Green Edition by im523.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

NjRat 0.7D Green Edition by im523(Beta).exe~__UNINST.EXE

description	pid	process	target process
PID 2176 wrote to memory of 2056	2176	NjRat 0.7D Green Edition by im523(Beta).exe	~__UNINST.EXE
PID 2176 wrote to memory of 2056	2176	NjRat 0.7D Green Edition by im523(Beta).exe	~__UNINST.EXE
PID 2176 wrote to memory of 2056	2176	NjRat 0.7D Green Edition by im523(Beta).exe	~__UNINST.EXE
PID 2176 wrote to memory of 2056	2176	NjRat 0.7D Green Edition by im523(Beta).exe	~__UNINST.EXE
PID 2176 wrote to memory of 2056	2176	NjRat 0.7D Green Edition by im523(Beta).exe	~__UNINST.EXE
PID 2176 wrote to memory of 2056	2176	NjRat 0.7D Green Edition by im523(Beta).exe	~__UNINST.EXE
PID 2176 wrote to memory of 2056	2176	NjRat 0.7D Green Edition by im523(Beta).exe	~__UNINST.EXE
PID 2056 wrote to memory of 2832	2056	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 2056 wrote to memory of 2832	2056	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 2056 wrote to memory of 2832	2056	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 2056 wrote to memory of 2832	2056	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 2056 wrote to memory of 2832	2056	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 2056 wrote to memory of 2832	2056	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 2056 wrote to memory of 2832	2056	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe

Filesize
1.6MB

MD5
1033c448810d3b507423546432e2f502

SHA1
2bf9d04f68ed15b957378fb95daa78c85d5b2b26

SHA256
f0c85722b88d1e7a1941ba17551cd5c29aef99fad86d78a5631a0f5446b3f580

SHA512
aeb964632dfad41fc383a68ace0e6beb152a7075f21a32e449624a27da5d2a5ccda0665fbd90597d65d74b0790877baf6f81336660b1df4bf38b41cd0bc6cd44

Download Submit
\Users\Admin\AppData\Local\Temp\~__UNINST.EXE

Filesize
1.7MB

MD5
2d3f9951b531061af499f324ca30f3ce

SHA1
090626c1013d4e30c182cddc881ef004b7289ede

SHA256
7914abca942a21058ca87cf2e19366ce41204fa1085008cb890f5853bc852b2d

SHA512
e8ef728be7d9fb55b95b52e0c3e0e87d2a6e560ec5df309878b13c447e349bd2885f5fe1ef4075392bc242523fa7d74aea9607f48194cbc241a39ba04e9b03a5

Download Submit