Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-10-2024 01:51
General
-
Target
d6b68928361ae07d5048c8b126efe974f22bf8b311de2d2faee50f18bd28ab9c.exe
-
Size
654KB
-
MD5
83e901a978502b12b11688d1bf742ef5
-
SHA1
92f530bee150a952153bfec430f11ba0e24bea51
-
SHA256
d6b68928361ae07d5048c8b126efe974f22bf8b311de2d2faee50f18bd28ab9c
-
SHA512
c8772079caa38a65d4964bb4818d304f13cf5c1f60cea93e4a0a4e501b5885da66abce6ce42603844df0c26fdb7c47dfcf704d77857fa6e8e643c107413268bb
-
SSDEEP
12288:tqjenzbxpLEGxvMnX3k9bdRWZXeogSBw/7TzJkDEz+tO0cJHK:tq09YYmMSB8z6Qz+kNK
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
encrypted7745.hopto.org:1177
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6b68928361ae07d5048c8b126efe974f22bf8b311de2d2faee50f18bd28ab9c.exe"C:\Users\Admin\AppData\Local\Temp\d6b68928361ae07d5048c8b126efe974f22bf8b311de2d2faee50f18bd28ab9c.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
680KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB