Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 22:28
General
-
Target
c0310df0f31ce1c56562d8f6c9e4398f90028ebfd49afaba760963b6510ad2af.exe
-
Size
2.2MB
-
MD5
2245fe5aceb9a49b4a455af092baffad
-
SHA1
bfc5557d1597a1d73cc2f24ae1d492ddb47620c1
-
SHA256
c0310df0f31ce1c56562d8f6c9e4398f90028ebfd49afaba760963b6510ad2af
-
SHA512
bc39f127e066c5a350883e3f8a40ee268ac35f1ea582f8c093aecf6aa8d0060f0d4760307d96480dc62b3f4cb005df6a6ead1763ac7256290bfc8aab6b03bdcf
-
SSDEEP
1536:mXhng5WlEimwwam+fgMtQW3hKfSsLnw5HzOsr05Kcgej8e6LXFqOi6:6hnwiQQgScw5i2
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
jokaretsoooo.ddns.net:5552
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0310df0f31ce1c56562d8f6c9e4398f90028ebfd49afaba760963b6510ad2af.exe"C:\Users\Admin\AppData\Local\Temp\c0310df0f31ce1c56562d8f6c9e4398f90028ebfd49afaba760963b6510ad2af.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB