Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26/11/2024, 12:24
General
-
Target
b63b91a9eac90862e4e13a524199505f882391680c89836da7b6a9a7b52436e9.exe
-
Size
54KB
-
MD5
512b1c1d3ec3e59e826973e08baddbf7
-
SHA1
2d08b1003d0a590e74ee9fbd0e2de6e22110de04
-
SHA256
b63b91a9eac90862e4e13a524199505f882391680c89836da7b6a9a7b52436e9
-
SHA512
4960189dc899edce882f93e0997f7666f8d0ac16e27409c7d1f084650b2fb0990d126553f3eea4bd6d3932d9fda17d4d70d7b5b2ac9440403506eba21a307419
-
SSDEEP
768:5iLUopHx2EsltsKlZuH+J3UqJSNfxWQG35bmaePD5PvHj2XXJdxIEpm5g2:5iLD9GtsK6+JjG5WQcGD9YX3xIEpm5g2
Score
10/10
Malware Config
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b63b91a9eac90862e4e13a524199505f882391680c89836da7b6a9a7b52436e9.exe"C:\Users\Admin\AppData\Local\Temp\b63b91a9eac90862e4e13a524199505f882391680c89836da7b6a9a7b52436e9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB