Overview

overview

10

Static

static

10

03bc37c41f...4e.exe

windows10-2004-x64

8

03bc37c41f...4e.exe

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    03bc37c41f16d9d57995345f18a4aa4e.exe
  • Size 93KB
  • Sample260423-w8nffset3p
  • SHA256 ee000adc82a8b416383531a5fa34bd319cd674801fed5735db5da2018d658437
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
njratlosiddefense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • Losid

C2

  • hakim32.ddns.net:2000

  • 5.tcp.eu.ngrok.io:14709

Mutex

  • e09804af3924226843af3b3c23f17c08

Attributes
  • reg_key

    e09804af3924226843af3b3c23f17c08

  • splitter

    |'|'|

Targets

    • Target
      03bc37c41f16d9d57995345f18a4aa4e.exe
    • Size 93KB
    • SHA256 ee000adc82a8b416383531a5fa34bd319cd674801fed5735db5da2018d658437
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoverypersistenceprivilege_escalation

    • Modifies Windows Firewall

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks