Analysis
-
max time kernel
1799s -
max time network
1802s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26-05-2024 10:55
General
-
Target
Njrat-main/NjRat 0.7D Green Edition by im523(Beta).exe
-
Size
1.7MB
-
MD5
2d3f9951b531061af499f324ca30f3ce
-
SHA1
090626c1013d4e30c182cddc881ef004b7289ede
-
SHA256
7914abca942a21058ca87cf2e19366ce41204fa1085008cb890f5853bc852b2d
-
SHA512
e8ef728be7d9fb55b95b52e0c3e0e87d2a6e560ec5df309878b13c447e349bd2885f5fe1ef4075392bc242523fa7d74aea9607f48194cbc241a39ba04e9b03a5
-
SSDEEP
49152:1UNixUNihxhA3333333333333QthBKthxeGlPAZwX:iiWijhA3333333333333QthIthxlPAZk
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Njrat-main\NjRat 0.7D Green Edition by im523(Beta).exe"C:\Users\Admin\AppData\Local\Temp\Njrat-main\NjRat 0.7D Green Edition by im523(Beta).exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~__UNINST.EXE"C:\Users\Admin\AppData\Local\Temp\~__UNINST.EXE" C:\Users\Admin\AppData\Local\Temp\Njrat-main\NjRat 0.7D Green Edition by im523(Beta).exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe"C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe" ADN3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE4⤵
- Modifies Windows Firewall
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD51033c448810d3b507423546432e2f502
SHA12bf9d04f68ed15b957378fb95daa78c85d5b2b26
SHA256f0c85722b88d1e7a1941ba17551cd5c29aef99fad86d78a5631a0f5446b3f580
SHA512aeb964632dfad41fc383a68ace0e6beb152a7075f21a32e449624a27da5d2a5ccda0665fbd90597d65d74b0790877baf6f81336660b1df4bf38b41cd0bc6cd44
-
Filesize
37KB
MD50ec2cec1259d0d1fa3399f25be9adb64
SHA14d7bb432d01f6854f978d6523d597641515dac4a
SHA256b6b110fb56c4a8830b654a46be266b25607e1f21385cb7df4b7484ac37dfe4bf
SHA51244748f5dbd9a0c4653581c21d20485d6cf06985e0a6625b977b98b9fae75436ec484923a2dfb7814d60ca88c94919dea05cfe5ffe649a67045adc25cf65eabd4
-
Filesize
1.7MB
MD52d3f9951b531061af499f324ca30f3ce
SHA1090626c1013d4e30c182cddc881ef004b7289ede
SHA2567914abca942a21058ca87cf2e19366ce41204fa1085008cb890f5853bc852b2d
SHA512e8ef728be7d9fb55b95b52e0c3e0e87d2a6e560ec5df309878b13c447e349bd2885f5fe1ef4075392bc242523fa7d74aea9607f48194cbc241a39ba04e9b03a5
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB