8c73a72c81a9363aa3414c16843346676435985bf175cb545e95c7cfc6e7c0cf

Analysis

max time kernel
29s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
njRAT-main/NjRAT.0.7.Danger.Edition/NjRat 0.7D Danger Edition.exe
Size 10.2MB
Sample240626-rwe64aydpd
SHA256 a83b5e33d310c5b523c99faa06787de04345ee21eff5322ea0bf4f0c14cf0e57
MD5 06e0d1b7c4e6712f430b3a47f9f87f34
SHA1 68444764f28c2ce512aa80526bc25d270a94eb1d
SHA512 6a52347ea407059dfc8582177d84cc9517cc6c9d85a1ff62aab893b20ef2b7789be8852371a0fbc17fe14aac130f248ca98efc450f1ab76d5a34bc00eaac6471
SSDEEP 196608:0qwQxJFTigAmoAG4bPUw7YS/hGIdInB6YvqmepwKoKsACmc2ZcefZd+I7N548Z:di7U7/hhiB6QOEKTXc47UG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	NjRat 0.7D Danger Edition.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	NjRat 0.7D Danger Edition.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4996	4880	NjRat 0.7D Danger Edition.exe	88
PID 4880 wrote to memory of 4996	4880	NjRat 0.7D Danger Edition.exe	88
PID 4996 wrote to memory of 5020	4996	NjRat 0.7D Danger Edition.exe	90
PID 4996 wrote to memory of 5020	4996	NjRat 0.7D Danger Edition.exe	90

C:\Users\Admin\AppData\Local\Temp\njRAT-main\NjRAT.0.7.Danger.Edition\NjRat 0.7D Danger Edition.exe
"C:\Users\Admin\AppData\Local\Temp\njRAT-main\NjRAT.0.7.Danger.Edition\NjRat 0.7D Danger Edition.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\njRAT-main\NjRAT.0.7.Danger.Edition\NjRat 0.7D Danger Edition.exe
  "C:\Users\Admin\AppData\Local\Temp\njRAT-main\NjRAT.0.7.Danger.Edition\NjRat 0.7D Danger Edition.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Users\Admin\AppData\Local\Temp\njRAT-main\NjRAT.0.7.Danger.Edition\NjRat 0.7D Danger Edition.exe
    "C:\Users\Admin\AppData\Local\Temp\njRAT-main\NjRAT.0.7.Danger.Edition\NjRat 0.7D Danger Edition.exe"
    3⤵
    PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads