Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

707087d720...8b.exe

windows7-x64

10

707087d720...8b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2024, 03:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe

  • Size

    26KB

  • MD5

    b18b55621e3032e65bea456162a4594d

  • SHA1

    711aa8f4491b96b4b0d8788d82af34822ad6ba37

  • SHA256

    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b

  • SHA512

    74079ddd994491b75e5b0cfd0191bcf0c88ad23b46da3cf32491a081bcaf9aa90fa9c2fdb5f413b504289fc46030f4ebc13c70fe999a957301ef56b16d32f9e0

  • SSDEEP

    384:/Ld6gKyjVg3fE0e9aHzCYe/CY2OzRLTm3yilqr6FobNtlvGG:zJtjVgPAaT5e/Csk+lvGG

Score
10/10
njratdiscoverytrojan

Malware Config

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    "C:\Users\Admin\AppData\Local\Temp\707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2492

Network

  • flag-us
    DNS
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    Remote address:
    8.8.8.8:53
    Request
    upe2023.duckdns.org
    IN A
    Response
    upe2023.duckdns.org
    IN A
    24.152.38.77
  • flag-us
    DNS
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    Remote address:
    8.8.8.8:53
    Request
    upe2023.duckdns.org
    IN A
    Response
    upe2023.duckdns.org
    IN A
    24.152.38.77
  • flag-us
    DNS
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    Remote address:
    8.8.8.8:53
    Request
    upe2023.duckdns.org
    IN A
    Response
    upe2023.duckdns.org
    IN A
    24.152.38.77
  • flag-us
    DNS
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    Remote address:
    8.8.8.8:53
    Request
    upe2023.duckdns.org
    IN A
    Response
    upe2023.duckdns.org
    IN A
    24.152.38.77
  • flag-us
    DNS
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    Remote address:
    8.8.8.8:53
    Request
    upe2023.duckdns.org
    IN A
    Response
    upe2023.duckdns.org
    IN A
    24.152.38.77
  • 24.152.38.77:1011
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    152 B
     3
  • 24.152.38.77:1011
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    152 B
     3
  • 24.152.38.77:1011
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    152 B
     3
  • 24.152.38.77:1011
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    152 B
     3
  • 24.152.38.77:1011
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    152 B
     3
  • 24.152.38.77:1011
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    152 B
     3
  • 24.152.38.77:1011
    upe2023.duckdns.org
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    152 B
     3
  • 8.8.8.8:53
    upe2023.duckdns.org
    dns
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    195 B
     243 B
     3
    3

    DNS Request

    upe2023.duckdns.org

    DNS Request

    upe2023.duckdns.org

    DNS Request

    upe2023.duckdns.org

    DNS Response

    24.152.38.77

    DNS Response

    24.152.38.77

    DNS Response

    24.152.38.77

  • 8.8.8.8:53
    upe2023.duckdns.org
    dns
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    65 B
     81 B
     1
    1

    DNS Request

    upe2023.duckdns.org

    DNS Response

    24.152.38.77

  • 8.8.8.8:53
    upe2023.duckdns.org
    dns
    707087d72031531f85139c0cda093b51dfa50e411a2dedbc7517139bdb2aa58b.exe
    65 B
     81 B
     1
    1

    DNS Request

    upe2023.duckdns.org

    DNS Response

    24.152.38.77

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2492-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2492-1-0x00000000001D0000-0x00000000001DC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2492-2-0x0000000074A10000-0x00000000750FE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2492-3-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2492-4-0x0000000074A10000-0x00000000750FE000-memory.dmp

    Filesize

    6.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.