Analysis
-
max time kernel
57s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 16:28
General
-
Target
af9a1baabfe853c60867995982763b19a5cb53524930fe4e3e149349c51bcddcN.exe
-
Size
38KB
-
MD5
ce2283cbadee69f3121bf2edf38d6d80
-
SHA1
a32a7bdf7efe4974ea7102de4a23ef14fa08d21a
-
SHA256
af9a1baabfe853c60867995982763b19a5cb53524930fe4e3e149349c51bcddc
-
SHA512
79ad56ebb57f86f04133d7b9786cfe93aeba422cde054795e3bdd4944d2c68f6333d83249faedb7ec4793c81eca3f2a636e9d477823c6c8be4856352786c7479
-
SSDEEP
768:W7fuHRm9lgWRWkbfcZQpEkU9OfzhBHNZHVb:qKRm0WfbfcOuHOfzf5
Score
10/10
Malware Config
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\af9a1baabfe853c60867995982763b19a5cb53524930fe4e3e149349c51bcddcN.exe"C:\Users\Admin\AppData\Local\Temp\af9a1baabfe853c60867995982763b19a5cb53524930fe4e3e149349c51bcddcN.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
10.8MB