Analysis
-
max time kernel
116s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-01-2025 08:45
General
-
Target
72f989d7a5d4e7f1b176c95998d6a0a1e575b05dd6882468ffad22366b63477d.exe
-
Size
71KB
-
MD5
d962b01af7f1bf5fd85effe5dd810cc5
-
SHA1
e6031da3b57b4954ebfb5a6f7dca0a5b982a5c65
-
SHA256
72f989d7a5d4e7f1b176c95998d6a0a1e575b05dd6882468ffad22366b63477d
-
SHA512
d740dcf91b5c89327f8a77f120126737035f472dc673c6923ef3bf39fa3c5b4e4cbeb6b8be40c4c85bb45e408adf8a06ee359c3f6dff4d7690c7b9ce0bbcc8d2
-
SSDEEP
1536:8GeFWPe3qNcoOSUq1zU7FJf2F0iZIq9XIft6/JT04GNrztiBVXiKMt9PMr+aF9bg:8B66vFAIf0T04xX/q9PZaF9b/4
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Platinum
Botnet
Victim
C2
http://pastetext.org/raw/eh2zaieezn:82
Mutex
svchost.exe
Attributes
-
reg_key
svchost.exe
-
splitter
|Ghost|
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\72f989d7a5d4e7f1b176c95998d6a0a1e575b05dd6882468ffad22366b63477d.exe"C:\Users\Admin\AppData\Local\Temp\72f989d7a5d4e7f1b176c95998d6a0a1e575b05dd6882468ffad22366b63477d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB