Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-11-2024 05:19
General
-
Target
fb106f8c95672b6e5d61d5cb2ee499ef3779610fd45ff85b357ac6da7cc23f35.exe
-
Size
54KB
-
MD5
d9c6c0fa21a4e31465b6fc7709e59dd0
-
SHA1
8c97e5faae3cce0e7194555fa550376c264b068d
-
SHA256
fb106f8c95672b6e5d61d5cb2ee499ef3779610fd45ff85b357ac6da7cc23f35
-
SHA512
788c98ee4e53071812791889487cd9f87e8e4c7d13111b3b38262bea901d6fd089cadad23c7a72ac54f50e7103041f91a10209ffe814e2479892316c9bc3e01b
-
SSDEEP
768:5iLUopHx2EsltsKlZuH+J3UqJSNfxWQG35bmaePD5PvHj2XXJdxIEpm5g:5iLD9GtsK6+JjG5WQcGD9YX3xIEpm5g
Score
10/10
Malware Config
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb106f8c95672b6e5d61d5cb2ee499ef3779610fd45ff85b357ac6da7cc23f35.exe"C:\Users\Admin\AppData\Local\Temp\fb106f8c95672b6e5d61d5cb2ee499ef3779610fd45ff85b357ac6da7cc23f35.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB