Overview
overview
10Static
static
103c7b097b31...0f.exe
windows7-x64
83c7b097b31...0f.exe
windows10-2004-x64
83c8a6c6cde...86.exe
windows7-x64
103c8a6c6cde...86.exe
windows10-2004-x64
103ca3e4676b...f1.exe
windows7-x64
103ca3e4676b...f1.exe
windows10-2004-x64
103cb47c4bbe...c1.exe
windows7-x64
103cb47c4bbe...c1.exe
windows10-2004-x64
103d18edb3bf...ff.exe
windows7-x64
13d18edb3bf...ff.exe
windows10-2004-x64
3d1ee6caf0...b4.exe
windows7-x64
103d1ee6caf0...b4.exe
windows10-2004-x64
103d2f05086d...0c.exe
windows7-x64
103d2f05086d...0c.exe
windows10-2004-x64
103d81f411b0...ba.exe
windows7-x64
103d81f411b0...ba.exe
windows10-2004-x64
103d90976d58...8c.exe
windows7-x64
103d90976d58...8c.exe
windows10-2004-x64
103d97ea72c5...9e.exe
windows7-x64
103d97ea72c5...9e.exe
windows10-2004-x64
103dd452b939...18.exe
windows7-x64
33dd452b939...18.exe
windows10-2004-x64
33dfc71cfc4...bd.exe
windows7-x64
103dfc71cfc4...bd.exe
windows10-2004-x64
103e435c9ff2...57.exe
windows7-x64
103e435c9ff2...57.exe
windows10-2004-x64
103e624f48a8...2b.exe
windows7-x64
13e624f48a8...2b.exe
windows10-2004-x64
43e8acfab95...cc.exe
windows7-x64
103e8acfab95...cc.exe
windows10-2004-x64
103e9a136b97...9d.exe
windows7-x64
103e9a136b97...9d.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:25
Behavioral task
behavioral1
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win7-20250207-en
Behavioral task
behavioral16
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral27
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win10v2004-20250314-en
General
-
Target
3d2f05086d9da9564c7c7e945875e80c.exe
-
Size
43KB
-
MD5
3d2f05086d9da9564c7c7e945875e80c
-
SHA1
2a691bccd730f0d1b20743f97ccde01ce625dee1
-
SHA256
f7faff3064d94d1977899b814099e4276349b80c7896c26142080d540e54a7dc
-
SHA512
05a876ed8e07d1750a4be4bd20904745fb96203e6bb05c9f861e91bb84ccc97cff0a463dd26e8bb8b5ba2128a98e82ee89433bcfed646b07f79d885c843e4ebf
-
SSDEEP
384:vZyrUJ1Cj8syWcWrf7E5GiXeEXME5EAftz8Iij+ZsNO3PlpJKkkjh/TzF7pWnU/N:ReUJ04pWcWr7E5ZVMEzXuXQ/o13+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
if-contest.gl.at.ply.gg:5461
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe 3d2f05086d9da9564c7c7e945875e80c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe 3d2f05086d9da9564c7c7e945875e80c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3d2f05086d9da9564c7c7e945875e80c.exe\" .." 3d2f05086d9da9564c7c7e945875e80c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3d2f05086d9da9564c7c7e945875e80c.exe\" .." 3d2f05086d9da9564c7c7e945875e80c.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d2f05086d9da9564c7c7e945875e80c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3984 3d2f05086d9da9564c7c7e945875e80c.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: 33 3984 3d2f05086d9da9564c7c7e945875e80c.exe Token: SeIncBasePriorityPrivilege 3984 3d2f05086d9da9564c7c7e945875e80c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d2f05086d9da9564c7c7e945875e80c.exe"C:\Users\Admin\AppData\Local\Temp\3d2f05086d9da9564c7c7e945875e80c.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3984