Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 22:11
Static task
static1
Behavioral task
behavioral1
Sample
83e901a978502b12b11688d1bf742ef5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
83e901a978502b12b11688d1bf742ef5.exe
Resource
win10v2004-20240802-en
General
-
Target
83e901a978502b12b11688d1bf742ef5.exe
-
Size
654KB
-
MD5
83e901a978502b12b11688d1bf742ef5
-
SHA1
92f530bee150a952153bfec430f11ba0e24bea51
-
SHA256
d6b68928361ae07d5048c8b126efe974f22bf8b311de2d2faee50f18bd28ab9c
-
SHA512
c8772079caa38a65d4964bb4818d304f13cf5c1f60cea93e4a0a4e501b5885da66abce6ce42603844df0c26fdb7c47dfcf704d77857fa6e8e643c107413268bb
-
SSDEEP
12288:tqjenzbxpLEGxvMnX3k9bdRWZXeogSBw/7TzJkDEz+tO0cJHK:tq09YYmMSB8z6Qz+kNK
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
encrypted7745.hopto.org:1177
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe 83e901a978502b12b11688d1bf742ef5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe 83e901a978502b12b11688d1bf742ef5.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\83e901a978502b12b11688d1bf742ef5.exe\" .." 83e901a978502b12b11688d1bf742ef5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\83e901a978502b12b11688d1bf742ef5.exe\" .." 83e901a978502b12b11688d1bf742ef5.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4928 83e901a978502b12b11688d1bf742ef5.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe Token: 33 4928 83e901a978502b12b11688d1bf742ef5.exe Token: SeIncBasePriorityPrivilege 4928 83e901a978502b12b11688d1bf742ef5.exe
Processes
Network
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request64.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestencrypted7745.hopto.orgIN AResponseencrypted7745.hopto.orgIN A85.113.101.120
-
Remote address:8.8.8.8:53Request120.101.113.85.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request120.101.113.85.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request120.101.113.85.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request98.117.19.2.in-addr.arpaIN PTRResponse98.117.19.2.in-addr.arpaIN PTRa2-19-117-98deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
64.159.190.20.in-addr.arpa
-
69 B 85 B 1 1
DNS Request
encrypted7745.hopto.org
DNS Response
85.113.101.120
-
219 B 219 B 3 3
DNS Request
120.101.113.85.in-addr.arpa
DNS Request
120.101.113.85.in-addr.arpa
DNS Request
120.101.113.85.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
98.117.19.2.in-addr.arpa
-
146 B 147 B 2 1
DNS Request
133.211.185.52.in-addr.arpa
DNS Request
133.211.185.52.in-addr.arpa
-
140 B 133 B 2 1
DNS Request
88.210.23.2.in-addr.arpa
DNS Request
88.210.23.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa