Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2024 02:35

General

  • Target

    ea15f53345104f775ba3bdb43e74a8256ac395f82390d2bfe69bd41b74af394f.exe

  • Size

    1.8MB

  • MD5

    62eb39057d95dd087a375494c49f9c59

  • SHA1

    4c767ef04e629c21c700d7f286af76953c86174b

  • SHA256

    ea15f53345104f775ba3bdb43e74a8256ac395f82390d2bfe69bd41b74af394f

  • SHA512

    19e15b07a8071d14b17712df3801dec1078aa8ed350792d809b8221c6bbd989991a58c156a607e69b961f8624dc81e22e532e7783846db941df4ef5c3ca853b2

  • SSDEEP

    1536:G1LOYSUxuJW9+I4x/pR7CbX3k0Y9HlAdu0VS2Djw/xxEcs51YgCggQFyWLPpi4hs:GCuuJg+I4x/fCbX3uvEgEcs511VThs

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

jokaretsoooo.ddns.net:5552

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea15f53345104f775ba3bdb43e74a8256ac395f82390d2bfe69bd41b74af394f.exe
    "C:\Users\Admin\AppData\Local\Temp\ea15f53345104f775ba3bdb43e74a8256ac395f82390d2bfe69bd41b74af394f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2336-0-0x000007FEF5DFE000-0x000007FEF5DFF000-memory.dmp

    Filesize

    4KB

  • memory/2336-1-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

    Filesize

    9.6MB

  • memory/2336-2-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

    Filesize

    9.6MB

  • memory/2336-4-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

    Filesize

    9.6MB

  • memory/2336-3-0x0000000000A50000-0x0000000000A62000-memory.dmp

    Filesize

    72KB

  • memory/2336-5-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

    Filesize

    9.6MB

  • memory/2336-6-0x000007FEF5DFE000-0x000007FEF5DFF000-memory.dmp

    Filesize

    4KB

  • memory/2336-7-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

    Filesize

    9.6MB

  • memory/2336-8-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

    Filesize

    9.6MB