Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d942da836a...4a.exe

windows7-x64

10

d942da836a...4a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/10/2024, 03:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a.exe

  • Size

    138KB

  • MD5

    4fb1ac905ae5c8aea4b23706f4474c4d

  • SHA1

    0717512f51a144b121bdcfa17575bb3cf2937a77

  • SHA256

    d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a

  • SHA512

    7872bd9d9f18f34cdb8f72c41ca061ec405ab0bad745409be9af4592c93e1aacee8622fe7d1040283b5903cc8cb4493324f95bb16f0dc3a940bf82695a7ac23a

  • SSDEEP

    3072:aMtdiO7525FVOxtEUxQ9E2Ue9qokTTp/7HgveVVe9C18:liUIJOINHUe9qoerVVe9C

Score
10/10
njrathackedtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:50

Mutex

e99e462d99ad204bdf7d672852a4e30a

Attributes
  • reg_key

    e99e462d99ad204bdf7d672852a4e30a

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a.exe
    "C:\Users\Admin\AppData\Local\Temp\d942da836a814ed7cdc398c5df73ccca81cb43c19be10a459d786d584d83104a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 416
      2⤵
        PID:1216

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1216-3-0x0000000000460000-0x0000000000461000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1248-0-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1248-1-0x0000000000570000-0x000000000057E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1248-4-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1248-2-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1248-5-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

      Filesize

      9.6MB

      Download