Overview
overview
10Static
static
10Payload.exe
windows7-x64
10Payload.exe
windows10-2004-x64
10Payload.exe
android-9-x86
Payload.exe
android-10-x64
Payload.exe
android-11-x64
Payload.exe
macos-10.15-amd64
Payload.exe
ubuntu-18.04-amd64
Payload.exe
debian-9-armhf
Payload.exe
debian-9-mips
Payload.exe
debian-9-mipsel
Analysis
-
max time kernel
900s -
max time network
896s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-01-2025 12:12
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
Payload.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Payload.exe
Resource
android-x86-arm-20240624-en
android-9-x86
Behavioral task
behavioral4
Sample
Payload.exe
Resource
android-x64-20240624-en
android-10-x64
Behavioral task
behavioral5
Sample
Payload.exe
Resource
android-x64-arm64-20240624-en
android-11-x64
Behavioral task
behavioral6
Sample
Payload.exe
Resource
macos-20241101-en
macos-10.15-amd64
Behavioral task
behavioral7
Sample
Payload.exe
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
Payload.exe
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral9
Sample
Payload.exe
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral10
Sample
Payload.exe
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
General
-
Target
Payload.exe
-
Size
55KB
-
MD5
a7b46a226d3b4e86c6d4700ed5dee333
-
SHA1
dfeaea8cbe59a1ec831aa288a1fc33639e8a7dd1
-
SHA256
fb731ca97406ae6dc235b69e8bca0d87e79f5e0a1c52f9e91f1775cea148d054
-
SHA512
3902246cba977c7dd4d74aad34a50af3250b51efe92f4010a060a3715ac3ff895a31481d18d311a1f3db5d1d248589d58a41e65d9768a95b9bb8031cab270026
-
SSDEEP
1536:ehDT8Dn+QNoB4vZ9Vk7dwmuXKDCwsNMD+XExI3pmgm:yf8Dn+nWTVk7umuXKDCwsNMD+XExI3pm
Malware Config
Signatures
-
Njrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe 1740 Payload.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1740 Payload.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe Token: SeIncBasePriorityPrivilege 1740 Payload.exe Token: 33 1740 Payload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exeC:\Users\Admin\AppData\Local\Temp\Payload.exe cmd /c %SIGILL% "SIGTERM|SIGKILL|SIGABRT"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1740