Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-10-2024 19:01
General
-
Target
Nigga.exe
-
Size
55KB
-
MD5
7a1624af489962ed1c60426a536e250c
-
SHA1
3ae27946c2dccb5ca0014d3b367dfb0b5f6bebc9
-
SHA256
441be6f69dd6bdfafdf7fa4596ef37ac3a8bf6cce2b9b9154c5f2f39c71e3d97
-
SHA512
a159818951c59d9eedccc70cc02dd5d65c8da7b0eebb5300d957614af8e71e64821bfcff3aa888a617f4cfccef4621c1534e70cd840753e04b733e7c71c652ca
-
SSDEEP
1536:B+oADn8fLNG/SbrKDD3wsNMDvXExI3pmjm:/ADncsqbeDD3wsNMDvXExI3pm
Score
10/10
Malware Config
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nigga.exe"C:\Users\Admin\AppData\Local\Temp\Nigga.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB