Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-10-2024 01:02
General
-
Target
af809a7846a623cd5f24c48bd70785909243da70a17a46b753d7dc856a0066c3N.exe
-
Size
2.1MB
-
MD5
d56461561f3059f2e813701fa8f6cc00
-
SHA1
7805b8f2434c00edba2345211309dacfdbc3cf44
-
SHA256
af809a7846a623cd5f24c48bd70785909243da70a17a46b753d7dc856a0066c3
-
SHA512
22f366d0518dc3e6d13a2f171c601c8c2f4925813dcb2575fbc5f84079dbff3c5e1953d74c12a1191cca375c8330cd73f8e16775f386fa9d96ddc895e9ea0323
-
SSDEEP
24576:lGxi5Rkwn374VL3KxLOC/kOlcqEwHh6efhd/:
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
jokaretsoooo.ddns.net:5552
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\af809a7846a623cd5f24c48bd70785909243da70a17a46b753d7dc856a0066c3N.exe"C:\Users\Admin\AppData\Local\Temp\af809a7846a623cd5f24c48bd70785909243da70a17a46b753d7dc856a0066c3N.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
9.6MB
-
Filesize
9.6MB