njrat | 9cc94b557cef772b9016893f8de0effff20c31d447c302223271db5433cc427b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 15:47

Target

9cc94b557cef772b9016893f8de0effff20c31d447c302223271db5433cc427bN.exe
Size

78KB
MD5

325a9949f709b3de45771feefecdacc0
SHA1

d3c25826a5a4e3099f231a748068fb882ecc340d
SHA256

9cc94b557cef772b9016893f8de0effff20c31d447c302223271db5433cc427b
SHA512

f9c3f9d261ec7b7161c45ea69c11200581baa3065ab9e5650e273b84d63552bbe5371ca844a09289802b240c9ade37274713b4e26e040076d2045227328f7fee
SSDEEP

1536:gUXF10zQoN36tKQviFw14fnqBnvbSfLteF3nLrB9z3nbaF9bKS9vMk:gUXF10zQoN36tKQviFC0qBn+fWl9zLad

Score

10^/10

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

Processes:

9cc94b557cef772b9016893f8de0effff20c31d447c302223271db5433cc427bN.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9cc94b557cef772b9016893f8de0effff20c31d447c302223271db5433cc427bN.exe

C:\Users\Admin\AppData\Local\Temp\9cc94b557cef772b9016893f8de0effff20c31d447c302223271db5433cc427bN.exe
"C:\Users\Admin\AppData\Local\Temp\9cc94b557cef772b9016893f8de0effff20c31d447c302223271db5433cc427bN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2848

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2848-0-0x00000000743FE000-0x00000000743FF000-memory.dmp

Filesize
4KB

Download
memory/2848-1-0x00000000010C0000-0x00000000010DA000-memory.dmp

Filesize
104KB

Download