njrat | 17cf67cf97f4235144a928eaa04bc13c60b3f17caae649d728035cf843deaa31

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-12-2024 19:57

Target

17cf67cf97f4235144a928eaa04bc13c60b3f17caae649d728035cf843deaa31.exe
Size

267KB
MD5

7e5f07b1d1f3d82b1d921e25c6e1aaa3
SHA1

3bdf0a91c0a3a3195f44f9f3074c0929048e20c3
SHA256

17cf67cf97f4235144a928eaa04bc13c60b3f17caae649d728035cf843deaa31
SHA512

600931eca764f09d96bb6058a253994ccc735d959382318f73d04e3d9fd433d8149dc82c1d638b27664597300d44171db375256c0e8c856c667f24cecf7ade72
SSDEEP

3072:onWg5lyjCxh0LBS17YpGolcqgNey6mPE6L/nA9svWlH2aiQXMi8sOjXo:63+oOwXqqeyBLL/nA9VH2s80qo

Score

10^/10

njrat trojan

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	17cf67cf97f4235144a928eaa04bc13c60b3f17caae649d728035cf843deaa31.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2716	2776	17cf67cf97f4235144a928eaa04bc13c60b3f17caae649d728035cf843deaa31.exe	30
PID 2776 wrote to memory of 2716	2776	17cf67cf97f4235144a928eaa04bc13c60b3f17caae649d728035cf843deaa31.exe	30
PID 2776 wrote to memory of 2716	2776	17cf67cf97f4235144a928eaa04bc13c60b3f17caae649d728035cf843deaa31.exe	30

C:\Users\Admin\AppData\Local\Temp\17cf67cf97f4235144a928eaa04bc13c60b3f17caae649d728035cf843deaa31.exe
"C:\Users\Admin\AppData\Local\Temp\17cf67cf97f4235144a928eaa04bc13c60b3f17caae649d728035cf843deaa31.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 576
  2⤵
  PID:2716

memory/2716-9-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2776-0-0x000007FEF587E000-0x000007FEF587F000-memory.dmp

Filesize
4KB

Download
memory/2776-1-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/2776-2-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-3-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-4-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-5-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-6-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-7-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-8-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-10-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2776-11-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download