Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-12-2024 02:07
General
-
Target
1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498.exe
-
Size
43KB
-
MD5
831391429d50f54bdad48209d87e7370
-
SHA1
8feb1f6f7df7863eb6aa711d952f4ac85f2d97f3
-
SHA256
1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498
-
SHA512
d19fc494de57e02f18162d7056cb93b7431dff4315d1300e9d1b6e9b95a8fa0d96a378a6896d1f0d604e17c4b55b3f72c90781d9bc1482e649d4c7d4fcc63dbc
-
SSDEEP
384:1ZyZcg98NaIyrtdd32E68ETiE7QzsIij+ZsNO3PlpJKkkjh/TzF7pWnYmgreT0pO:f4ywFrLd32HfquXQ/oRC+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
4.tcp.eu.ngrok.io:16948
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498.exe"C:\Users\Admin\AppData\Local\Temp\1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
7.7MB