njrat | d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-10-2024 03:38

Target

d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a.exe
Size

138KB
MD5

4fb1ac905ae5c8aea4b23706f4474c4d
SHA1

0717512f51a144b121bdcfa17575bb3cf2937a77
SHA256

d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a
SHA512

7872bd9d9f18f34cdb8f72c41ca061ec405ab0bad745409be9af4592c93e1aacee8622fe7d1040283b5903cc8cb4493324f95bb16f0dc3a940bf82695a7ac23a
SSDEEP

3072:aMtdiO7525FVOxtEUxQ9E2Ue9qokTTp/7HgveVVe9C18:liUIJOINHUe9qoerVVe9C

Score

10^/10

njrat hacked trojan

Family

njrat

Version

0.7d

Botnet

HacKed

127.0.0.1:50

Mutex

e99e462d99ad204bdf7d672852a4e30a

Attributes

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1960	2500	d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a.exe	30
PID 2500 wrote to memory of 1960	2500	d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a.exe	30
PID 2500 wrote to memory of 1960	2500	d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a.exe	30

C:\Users\Admin\AppData\Local\Temp\d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a.exe
"C:\Users\Admin\AppData\Local\Temp\d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 416
  2⤵
  PID:1960

memory/1960-4-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2500-0-0x000007FEF61CE000-0x000007FEF61CF000-memory.dmp

Filesize
4KB

Download
memory/2500-1-0x0000000000350000-0x000000000035E000-memory.dmp

Filesize
56KB

Download
memory/2500-2-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2500-3-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download
memory/2500-5-0x000007FEF5F10000-0x000007FEF68AD000-memory.dmp

Filesize
9.6MB

Download