Overview
overview
10Static
static
3WindowsApp1.exe
windows7-x64
10WindowsApp1.exe
windows10-2004-x64
10WindowsApp1.exe
android-9-x86
WindowsApp1.exe
android-10-x64
WindowsApp1.exe
android-11-x64
WindowsApp1.exe
macos-10.15-amd64
WindowsApp1.exe
ubuntu-18.04-amd64
WindowsApp1.exe
debian-9-armhf
WindowsApp1.exe
debian-9-mips
WindowsApp1.exe
debian-9-mipsel
Analysis
-
max time kernel
900s -
max time network
897s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2025 12:16
Static task
static1
Behavioral task
behavioral1
Sample
WindowsApp1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
WindowsApp1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
WindowsApp1.exe
Resource
android-x86-arm-20240624-en
android-9-x86
Behavioral task
behavioral4
Sample
WindowsApp1.exe
Resource
android-x64-20240624-en
android-10-x64
Behavioral task
behavioral5
Sample
WindowsApp1.exe
Resource
android-x64-arm64-20240624-en
android-11-x64
Behavioral task
behavioral6
Sample
WindowsApp1.exe
Resource
macos-20241101-en
macos-10.15-amd64
Behavioral task
behavioral7
Sample
WindowsApp1.exe
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
WindowsApp1.exe
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral9
Sample
WindowsApp1.exe
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral10
Sample
WindowsApp1.exe
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
General
-
Target
WindowsApp1.exe
-
Size
477KB
-
MD5
b5861d91a75a20e8811cefea4af1fe18
-
SHA1
07defcf78334ffd145cdb4ff2e1163e257c4b957
-
SHA256
5acde150ebdddc2fc69833d95691746d5c471dc08e74fe0aeb96d06670a536e7
-
SHA512
072486eca2641fbb5efa4411a067d6c0658e71aed9a2521dd5e5321fab9ee490dfce0b11ea9c008ac054a007be5a8c2801c5a79662c30e984a756e8e7f26722a
-
SSDEEP
12288:fqNB6ENSUO91dS039TrZgrirZXe1i709aEUpRegYyLs:+QEoUO3dS0tTxXeQ70W3
Malware Config
Signatures
-
Njrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WindowsApp1.exe -
Executes dropped EXE 1 IoCs
pid Process 4064 .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language .exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe 4064 .exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4064 .exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 212 WindowsApp1.exe Token: SeDebugPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe Token: 33 4064 .exe Token: SeIncBasePriorityPrivilege 4064 .exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 212 wrote to memory of 4064 212 WindowsApp1.exe 83 PID 212 wrote to memory of 4064 212 WindowsApp1.exe 83 PID 212 wrote to memory of 4064 212 WindowsApp1.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowsApp1.exeC:\Users\Admin\AppData\Local\Temp\WindowsApp1.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5ac5ef973fc76ab6ff614dcb3bd452ce8
SHA19d50255db0555a85a5a951a603b751c1a9eb3212
SHA25665fec5b3720c81dca478b5b2cd29b68732f3fbddfb4a76b59df691a2f264acb8
SHA512620d6b1ee771ad9dab13e5a855733f216d00f2b98c35fad9c5b152210ed12214c01d6bd05665f8687210a75993ee0ae321b666deceaf0afcb796013f93379a3a