2ce8cb36ecb4fd1fc004ac64495da7252223753658440fee143f9e6ce4b27d05

Analysis

max time kernel
1563s
max time network
1564s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 10:55

Target

Njrat-main/NjRat 0.7D Green Edition by im523.exe
Size

20.2MB
MD5

348c0bd0ef7201d06bf159e115aa8260
SHA1

86395b0584650b9741af89ba45432558479f8111
SHA256

68028a6306c0343792b73783806e45c47b3b2c332580e6dd7c14efce4571f014
SHA512

6f3bedf2e8c4cb91a496dcdc371dc19839e50a0308927039e29958f49f529324f6665f0a85a1b4bc2c6c23eee493fefbee8fa2f5fcc5000a64a600caedd21203
SSDEEP

393216:z3333333333333qafiI6bReDy4HRamQ0qGCgVSfF+kxAb+nwSuPf06zMrqnoZHjP:z3333333333333NfklP4HRbQ0wuzjM6m

Score

7^/10

Executes dropped EXE 2 IoCs

Processes:

~__UNINST.EXENjRat 0.7D Green Edition by im523.exe

pid process

1068 ~__UNINST.EXE
3060 NjRat 0.7D Green Edition by im523.exe

pid	process
1068	~__UNINST.EXE
3060	NjRat 0.7D Green Edition by im523.exe

Loads dropped DLL 7 IoCs

Processes:

NjRat 0.7D Green Edition by im523.exe~__UNINST.EXENjRat 0.7D Green Edition by im523.exe

pid	process
2820	NjRat 0.7D Green Edition by im523.exe
1068	~__UNINST.EXE
1068	~__UNINST.EXE
1068	~__UNINST.EXE
1068	~__UNINST.EXE
3060	NjRat 0.7D Green Edition by im523.exe
3060	NjRat 0.7D Green Edition by im523.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

NjRat 0.7D Green Edition by im523.exe

pid process

3060 NjRat 0.7D Green Edition by im523.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

NjRat 0.7D Green Edition by im523.exe

pid process

3060 NjRat 0.7D Green Edition by im523.exe

pid	process
3060	NjRat 0.7D Green Edition by im523.exe

pid	process
3060	NjRat 0.7D Green Edition by im523.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

NjRat 0.7D Green Edition by im523.exe~__UNINST.EXE

description	pid	process	target process
PID 2820 wrote to memory of 1068	2820	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 2820 wrote to memory of 1068	2820	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 2820 wrote to memory of 1068	2820	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 2820 wrote to memory of 1068	2820	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 2820 wrote to memory of 1068	2820	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 2820 wrote to memory of 1068	2820	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 2820 wrote to memory of 1068	2820	NjRat 0.7D Green Edition by im523.exe	~__UNINST.EXE
PID 1068 wrote to memory of 3060	1068	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 1068 wrote to memory of 3060	1068	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 1068 wrote to memory of 3060	1068	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 1068 wrote to memory of 3060	1068	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 1068 wrote to memory of 3060	1068	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 1068 wrote to memory of 3060	1068	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe
PID 1068 wrote to memory of 3060	1068	~__UNINST.EXE	NjRat 0.7D Green Edition by im523.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe

Filesize
1.6MB

MD5
1033c448810d3b507423546432e2f502

SHA1
2bf9d04f68ed15b957378fb95daa78c85d5b2b26

SHA256
f0c85722b88d1e7a1941ba17551cd5c29aef99fad86d78a5631a0f5446b3f580

SHA512
aeb964632dfad41fc383a68ace0e6beb152a7075f21a32e449624a27da5d2a5ccda0665fbd90597d65d74b0790877baf6f81336660b1df4bf38b41cd0bc6cd44

Download Submit
\Users\Admin\AppData\Local\Temp\~__UNINST.EXE

Filesize
20.2MB

MD5
348c0bd0ef7201d06bf159e115aa8260

SHA1
86395b0584650b9741af89ba45432558479f8111

SHA256
68028a6306c0343792b73783806e45c47b3b2c332580e6dd7c14efce4571f014

SHA512
6f3bedf2e8c4cb91a496dcdc371dc19839e50a0308927039e29958f49f529324f6665f0a85a1b4bc2c6c23eee493fefbee8fa2f5fcc5000a64a600caedd21203

Download Submit