njrat | ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72df

General

Target

ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Size

43KB
MD5

6cfc0db08cfdb9d82e675115da38f660
SHA1

b5731b939b4561c8291a92fc0c178d2b35da6286
SHA256

ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72df
SHA512

71285c50be8a8ab4452e477c9598e89a3168c5d991f6ac46bab3e8c8b036a03ffadad830bc8addfbfc42c4e983fc96d5d4b4dab8b7635cb56cd07bf69ba84732
SSDEEP

384:UZyaJNxdW/IUyNZs/5OFile+eEzll56ljzYIij+ZsNO3PlpJKkkjh/TzF7pWnpml:invxIghNZ85OFillhlyDuXQ/o0C+L

Score

10^/10

njrat hacked discovery trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

148.251.75.168:2709

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: 33	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
Token: SeIncBasePriorityPrivilege	1064	ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe

C:\Users\Admin\AppData\Local\Temp\ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
"C:\Users\Admin\AppData\Local\Temp\ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-0-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download
memory/1064-1-0x0000000000D40000-0x0000000000D52000-memory.dmp

Filesize
72KB

Download
memory/1064-2-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download
memory/1064-3-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download
memory/1064-4-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing