2ce8cb36ecb4fd1fc004ac64495da7252223753658440fee143f9e6ce4b27d05

Analysis

max time kernel
615s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26-05-2024 10:55

Target

Njrat-main/NjRat 0.7D Green Edition by im523.exe
Size

20.2MB
MD5

348c0bd0ef7201d06bf159e115aa8260
SHA1

86395b0584650b9741af89ba45432558479f8111
SHA256

68028a6306c0343792b73783806e45c47b3b2c332580e6dd7c14efce4571f014
SHA512

6f3bedf2e8c4cb91a496dcdc371dc19839e50a0308927039e29958f49f529324f6665f0a85a1b4bc2c6c23eee493fefbee8fa2f5fcc5000a64a600caedd21203
SSDEEP

393216:z3333333333333qafiI6bReDy4HRamQ0qGCgVSfF+kxAb+nwSuPf06zMrqnoZHjP:z3333333333333NfklP4HRbQ0wuzjM6m

Score

7^/10

Executes dropped EXE 2 IoCs

Processes:

~__UNINST.EXENjRat 0.7D Green Edition by im523.exe

pid process

668 ~__UNINST.EXE
4676 NjRat 0.7D Green Edition by im523.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NjRat 0.7D Green Edition by im523.exe

pid process

4676 NjRat 0.7D Green Edition by im523.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

NjRat 0.7D Green Edition by im523.exe

pid process

4676 NjRat 0.7D Green Edition by im523.exe

pid	process
668	~__UNINST.EXE
4676	NjRat 0.7D Green Edition by im523.exe

pid	process
4676	NjRat 0.7D Green Edition by im523.exe

pid	process
4676	NjRat 0.7D Green Edition by im523.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

NjRat 0.7D Green Edition by im523.exe~__UNINST.EXE

description	pid	process	target process
PID 2084 wrote to memory of 668	2084	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 2084 wrote to memory of 668	2084	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 2084 wrote to memory of 668	2084	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 668 wrote to memory of 4676	668	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 668 wrote to memory of 4676	668	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 668 wrote to memory of 4676	668	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe

C:\Users\Admin\AppData\Local\Temp\Njrat-main\NjRat 0.7D Green Edition by im523.exe
"C:\Users\Admin\AppData\Local\Temp\Njrat-main\NjRat 0.7D Green Edition by im523.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\~__UNINST.EXE
  "C:\Users\Admin\AppData\Local\Temp\~__UNINST.EXE" C:\Users\Admin\AppData\Local\Temp\Njrat-main\NjRat 0.7D Green Edition by im523.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe
    "C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4676

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe

Filesize
1.6MB

MD5
1033c448810d3b507423546432e2f502

SHA1
2bf9d04f68ed15b957378fb95daa78c85d5b2b26

SHA256
f0c85722b88d1e7a1941ba17551cd5c29aef99fad86d78a5631a0f5446b3f580

SHA512
aeb964632dfad41fc383a68ace0e6beb152a7075f21a32e449624a27da5d2a5ccda0665fbd90597d65d74b0790877baf6f81336660b1df4bf38b41cd0bc6cd44

Download Submit
C:\Users\Admin\AppData\Local\Temp\~__UNINST.EXE

Filesize
20.2MB

MD5
348c0bd0ef7201d06bf159e115aa8260

SHA1
86395b0584650b9741af89ba45432558479f8111

SHA256
68028a6306c0343792b73783806e45c47b3b2c332580e6dd7c14efce4571f014

SHA512
6f3bedf2e8c4cb91a496dcdc371dc19839e50a0308927039e29958f49f529324f6665f0a85a1b4bc2c6c23eee493fefbee8fa2f5fcc5000a64a600caedd21203

Download Submit
memory/4676-13-0x00000000732E1000-0x00000000732E2000-memory.dmp

Filesize
4KB

Download
memory/4676-14-0x00000000732E0000-0x0000000073890000-memory.dmp

Filesize
5.7MB

Download
memory/4676-15-0x00000000732E0000-0x0000000073890000-memory.dmp

Filesize
5.7MB

Download
memory/4676-16-0x00000000732E0000-0x0000000073890000-memory.dmp

Filesize
5.7MB

Download