Analysis
-
max time kernel
117s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-10-2024 12:36
General
-
Target
ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe
-
Size
43KB
-
MD5
6cfc0db08cfdb9d82e675115da38f660
-
SHA1
b5731b939b4561c8291a92fc0c178d2b35da6286
-
SHA256
ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72df
-
SHA512
71285c50be8a8ab4452e477c9598e89a3168c5d991f6ac46bab3e8c8b036a03ffadad830bc8addfbfc42c4e983fc96d5d4b4dab8b7635cb56cd07bf69ba84732
-
SSDEEP
384:UZyaJNxdW/IUyNZs/5OFile+eEzll56ljzYIij+ZsNO3PlpJKkkjh/TzF7pWnpml:invxIghNZ85OFillhlyDuXQ/o0C+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
148.251.75.168:2709
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe"C:\Users\Admin\AppData\Local\Temp\ab3b97a8cc506737750b570c5d4bb1543153136f67781bfa908dc025fd1c72dfN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
7.7MB