Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-12-2024 05:42
Behavioral task
behavioral1
Sample
Server2.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
-
Target
Server2.exe
-
Size
43KB
-
MD5
87ced1ba3c69b71f240b3f6c0b509da7
-
SHA1
7789d982cd71a9a678dafe754e51fef694f52118
-
SHA256
fbfbe53bab2fb9b06ed9df34a389a9529ff11cd0896486c883c0a26968f91099
-
SHA512
e9af83946b47ebc0cde33716cbf9eaab2cda9d583a1a9cf293ca3070fd10e5065f92693a6f47afebdac6764a4511f95602159a589bf8ed7f26f584dee24f8284
-
SSDEEP
384:3ZyjJ61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnKmgreTf:J0Qk4smKS3OR9Z0OuXQ/ovC+L
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
92.253.28.170:5552
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server2.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2276 Server2.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: SeDebugPrivilege 2944 taskmgr.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe Token: 33 2276 Server2.exe Token: SeIncBasePriorityPrivilege 2276 Server2.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe 2944 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server2.exe"C:\Users\Admin\AppData\Local\Temp\Server2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2944