Analysis
- max time kernel
150s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:48
General
- Target 3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13.exe
- Size 126KB
- Sample201109-ppxdxthd6s
- SHA256 3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13
Score
10/10
Malware Config
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Executes dropped EXE 1 IoCs
- Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 33 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13.exe"C:\Users\Admin\AppData\Local\Temp\3e472f9bb6ff7d05c153d332dd2deb6e56631c4e85472a8c04a140ca18e46b13.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\servernj.exe"C:\Users\Admin\AppData\Local\Temp\servernj.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\servernj.exe" "servernj.exe" ENABLE3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/984-4-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/984-0-0x0000000073310000-0x00000000739FE000-memory.dmp
memory/984-5-0x0000000005F50000-0x0000000005F51000-memory.dmp
memory/984-6-0x0000000005A50000-0x0000000005A51000-memory.dmp
memory/984-7-0x0000000005980000-0x0000000005981000-memory.dmp
memory/984-8-0x0000000005C70000-0x0000000005C71000-memory.dmp
memory/984-9-0x00000000090E0000-0x00000000090E6000-memory.dmp
memory/984-3-0x0000000005800000-0x0000000005809000-memory.dmp
memory/984-1-0x0000000000F50000-0x0000000000F51000-memory.dmp
memory/1296-13-0x0000000073310000-0x00000000739FE000-memory.dmp