Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 02:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
General
-
Target
3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe
-
Size
26KB
-
MD5
5a02e3b739d3131e915d7742cfc7e8c7
-
SHA1
7cd9d8b4869e729d2950689c5ec01546b6965491
-
SHA256
3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0
-
SHA512
00802053160afd3dbce025c241e3538b125a46df109e6a53dbe3baf3f91c783e7680bf4061b992dcdbd61abbf4463252964fff09adc2ea3140ba9c8324a1e88f
-
SSDEEP
384:pLd6ImXDZ/XgPMRefHzCYe/iBY2OzRLTm3yilqr638bAtVvGz:ZxMDZ/+MMT5e/gsE5VvGz
Malware Config
Signatures
-
Njrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: SeIncBasePriorityPrivilege 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe Token: 33 2112 3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe"C:\Users\Admin\AppData\Local\Temp\3c2c43d7edd4a198a246c41ccad5df318cf320dc559eed681e403bbb5ba9a7d0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2112