Overview

overview

10

Static

static

3

f857377bc7...7N.exe

windows7-x64

10

f857377bc7...7N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-10-2024 17:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f857377bc716ab8482b4616dcff2565f1856ffee5d1a9f689e09e531e30b3687N.exe

  • Size

    1.5MB

  • MD5

    6a21cde8b8a7b0f807a7ee0dafb29da0

  • SHA1

    713d148daafc2b5805cbca810fc2908e8a1b20ed

  • SHA256

    f857377bc716ab8482b4616dcff2565f1856ffee5d1a9f689e09e531e30b3687

  • SHA512

    d98a84ed7a08d239007d6fe4969619719dafc8351aad07028d2dca7c3b8e2abbe6d9e00631ffaf40e616166797b948e7f0afd869ab09f364fb5ba852ca402a30

  • SSDEEP

    24576:4uDXTIGaPhEYzUzA0dfKxD4BUzQibSmCCIKHr8gUYEvtz97szUjtQ5GHG3:3Djlabwz98ZnzbbP5Hr8p1v0wQGHo

Score
10/10
njratpaper vpndiscoverytrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

Paper VPN

C2

race-frequent.gl.at.ply.gg:32547

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f857377bc716ab8482b4616dcff2565f1856ffee5d1a9f689e09e531e30b3687N.exe
    "C:\Users\Admin\AppData\Local\Temp\f857377bc716ab8482b4616dcff2565f1856ffee5d1a9f689e09e531e30b3687N.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\PaperVPN-Client-2.0.8.exe
      "C:\Users\Admin\AppData\Local\Temp\PaperVPN-Client-2.0.8.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\PaperVPN-Client-2.0.8.exe
    Filesize

    1.1MB

    MD5

    7a793192aac071096b1d2ddfc757fdb5

    SHA1

    3f2640cd57086c88247d413f4541354b35716025

    SHA256

    0a8df0854a3767b3076aba4349dce0ce8b6fcdf5d14a3dc8c880b0d9c9be07fe

    SHA512

    9a591228665e0634248ccb2f1fcbac3d7deed9275b60e1d0e344cd210d2bb66b324434832e4ac032befd1bb3767067a55e1c204bfeadbc6fdfa6338d4d0aa03a

    Download Submit

  • memory/1632-10-0x00000000010D0000-0x0000000001446000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/1632-12-0x000000007458E000-0x000000007458F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1632-13-0x00000000010D0000-0x0000000001446000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/1632-14-0x0000000074580000-0x0000000074C6E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1632-15-0x000000007458E000-0x000000007458F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1632-17-0x0000000074580000-0x0000000074C6E000-memory.dmp

    Filesize

    6.9MB

    Download