Overview

overview

10

Static

static

10

ee5fd05cf5...c3.exe

windows7-x64

7

ee5fd05cf5...c3.exe

windows10-2004-x64

7

ee69b74300...91.exe

windows7-x64

10

ee69b74300...91.exe

windows10-2004-x64

10

ee907a3b63...42.exe

windows7-x64

10

ee907a3b63...42.exe

windows10-2004-x64

10

eea4dcd11b...6f.exe

windows7-x64

10

eea4dcd11b...6f.exe

windows10-2004-x64

10

eebe0a35fa...82.exe

windows7-x64

10

eebe0a35fa...82.exe

windows10-2004-x64

10

eee37b5af1...b0.exe

windows7-x64

10

eee37b5af1...b0.exe

windows10-2004-x64

10

eeeaec4088...b4.exe

windows7-x64

eeeaec4088...b4.exe

windows10-2004-x64

eeffb35d2a...98.exe

windows7-x64

10

eeffb35d2a...98.exe

windows10-2004-x64

10

ef1a8eac84...30.exe

windows7-x64

8

ef1a8eac84...30.exe

windows10-2004-x64

8

ef5d9dc508...d4.exe

windows7-x64

10

ef5d9dc508...d4.exe

windows10-2004-x64

10

ef9c94ed2f...f4.exe

windows7-x64

10

ef9c94ed2f...f4.exe

windows10-2004-x64

10

efa0bac8ed...d4.exe

windows7-x64

5

efa0bac8ed...d4.exe

windows10-2004-x64

5

efb13a6c7f...aa.exe

windows7-x64

7

efb13a6c7f...aa.exe

windows10-2004-x64

7

efbf15e364...42.exe

windows7-x64

7

efbf15e364...42.exe

windows10-2004-x64

7

efdcbe8680...47.exe

windows7-x64

7

efdcbe8680...47.exe

windows10-2004-x64

7

eff37c0a73...c5.exe

windows7-x64

10

eff37c0a73...c5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ef5d9dc50867f0430aabd8e6696b76d4.exe

  • Size

    43KB

  • MD5

    ef5d9dc50867f0430aabd8e6696b76d4

  • SHA1

    50f1ba52f2c2a267be79420096d6e51eaca51c71

  • SHA256

    dacf484637d5c59cb0f5237ac36f762172b73ead8e16d81a3333656f6eecda57

  • SHA512

    d60699916826738cd0b1c5dcbe1a2e7b2488d08b2936efd6d9067954bd40882d16104cc4df80019a66c3bdf80bcb2f2b20e681c5d89857f22235b31b4efc58c1

  • SSDEEP

    384:ZZy+Hl9n1iDcsyEqt3ptKwQsElGhOEazcIij+ZsNO3PlpJKkkjh/TzF7pWn5mgra:799nU4pEqt5tKhohuuXQ/o8C+L

Score
10/10
njrathackeddiscoverytrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef5d9dc50867f0430aabd8e6696b76d4.exe
    "C:\Users\Admin\AppData\Local\Temp\ef5d9dc50867f0430aabd8e6696b76d4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2296-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2296-1-0x0000000000310000-0x0000000000322000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2296-2-0x0000000074BC0000-0x00000000752AE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2296-3-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2296-4-0x0000000074BC0000-0x00000000752AE000-memory.dmp

    Filesize

    6.9MB

    Download