Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 01:26
General
-
Target
6650a384367acf072fc798cfc0c40e74.exe
-
Size
512KB
-
MD5
6650a384367acf072fc798cfc0c40e74
-
SHA1
aa89e965c2b5904d8c970ff21e4159cd63bcaf99
-
SHA256
f4bc8c2bcd243d67ed8cd5442dcc07460790dbcfa0d04a245f9333b900f7c022
-
SHA512
658dde54c128e0e4e8ff33c4e2deebed1251c0cc95920026023a9a0bb0f895ba877aa56ec58f0db10a9e4878a146a9d0c11ea92d924829fdbbefaa53dc52bee6
-
SSDEEP
12288:RYIsJ6miMYnyTF4Pb47oDYIWtA2VpLIqAY:YPiMYnymj47oDYIWtfpL
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
encrypted7745.hopto.org:1177
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6650a384367acf072fc798cfc0c40e74.exe"C:\Users\Admin\AppData\Local\Temp\6650a384367acf072fc798cfc0c40e74.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB