Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2025, 22:08
Behavioral task
behavioral1
Sample
Payload.exe.bin.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Payload.exe.bin.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Payload.exe.bin.exe
-
Size
54KB
-
MD5
ce41897c33ae593ef9d95f05d76d4668
-
SHA1
e9917d00b854c4ee8ccc016771c790ae83bea47b
-
SHA256
3e3d179f29cdfe42f64cd6e269abf78d291b40fea7d3c2f422810273e68176ae
-
SHA512
8d0da6bef8ba2bf1affb7809140d608af37443628b75cc54764ba8f57d18fa7a47aa6c51f713c8b0992f2e51316a4aaf2f70ae2791eee7442aa876d5b4824747
-
SSDEEP
768:JrNN6zR2EsltIxhLV43K2JSNeexWQG35bmaePD5Pvr2XXJdxIEpmXg:Jr8dGtShx4lGeMWQcGD2X3xIEpmXg
Score
10/10
Malware Config
Signatures
-
Njrat family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\de7e1bdc0c3d602ad997d6c79062d369.exe Payload.exe.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\de7e1bdc0c3d602ad997d6c79062d369.exe Payload.exe.bin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\de7e1bdc0c3d602ad997d6c79062d369 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe.bin.exe\" .." Payload.exe.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\de7e1bdc0c3d602ad997d6c79062d369 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe.bin.exe\" .." Payload.exe.bin.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe.bin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe 3068 Payload.exe.bin.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe Token: 33 3068 Payload.exe.bin.exe Token: SeIncBasePriorityPrivilege 3068 Payload.exe.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe.bin.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe.bin.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068