Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
23/07/2024, 12:31
General
- Target 9407D488CE708562EC4EAE45FAEDE739.exe
- Size 604KB
- Sample240723-pp3byasfpe
- SHA256 74877604fd5801b2891e361de42ead1c0b7e1a04f4cde182bee5a30f1971eceb
Malware Config
Extracted
-
njrat
-
0.7NC
-
NYAN CAT
-
seznam.zapto.org:5050
-
76c8ec7d474b4123895
-
reg_key
76c8ec7d474b4123895
-
splitter
@!#&^%$
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9407D488CE708562EC4EAE45FAEDE739.exe"C:\Users\Admin\AppData\Local\Temp\9407D488CE708562EC4EAE45FAEDE739.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/440-0-0x000000007472E000-0x000000007472F000-memory.dmp
memory/440-1-0x00000000004D0000-0x000000000056C000-memory.dmp
memory/440-2-0x0000000005660000-0x0000000005C04000-memory.dmp
memory/440-3-0x0000000004F60000-0x0000000004FF2000-memory.dmp
memory/440-4-0x0000000004EC0000-0x0000000004ECC000-memory.dmp
memory/440-5-0x00000000050B0000-0x000000000514C000-memory.dmp
memory/440-6-0x0000000074720000-0x0000000074ED0000-memory.dmp
memory/440-7-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/440-8-0x00000000053A0000-0x0000000005406000-memory.dmp
memory/440-9-0x000000007472E000-0x000000007472F000-memory.dmp
memory/440-10-0x0000000074720000-0x0000000074ED0000-memory.dmp