Analysis
- max time kernel
150s - max time network
123s - platform
windows10_x64 - resource
win10v20201028 - submitted
28/02/2021, 07:17
General
- Target bbc467be402fa10957b329f79484dd0dfbf30ca52ed4275f0fa2085807786f5a.exe
- Size 276KB
- Sample210228-p77na178f6
- SHA256 bbc467be402fa10957b329f79484dd0dfbf30ca52ed4275f0fa2085807786f5a
Malware Config
Extracted
-
njrat
-
0.7d
-
HacKed
-
127.0.0.1:5552
-
165d6ed988ac1dbec1627a1ca9899d84
-
reg_key
165d6ed988ac1dbec1627a1ca9899d84
-
splitter
|'|'|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Modifies Windows Firewall 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbc467be402fa10957b329f79484dd0dfbf30ca52ed4275f0fa2085807786f5a.exe"C:\Users\Admin\AppData\Local\Temp\bbc467be402fa10957b329f79484dd0dfbf30ca52ed4275f0fa2085807786f5a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bbc467be402fa10957b329f79484dd0dfbf30ca52ed4275f0fa2085807786f5a.exeC:\Users\Admin\AppData\Local\Temp\bbc467be402fa10957b329f79484dd0dfbf30ca52ed4275f0fa2085807786f5a.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\bbc467be402fa10957b329f79484dd0dfbf30ca52ed4275f0fa2085807786f5a.exe" "bbc467be402fa10957b329f79484dd0dfbf30ca52ed4275f0fa2085807786f5a.exe" ENABLE3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1908-10-0x0000000005040000-0x0000000005041000-memory.dmp
memory/1908-6-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/1908-7-0x0000000004F10000-0x0000000004F15000-memory.dmp
memory/1908-2-0x0000000073920000-0x000000007400E000-memory.dmp
memory/1908-11-0x0000000002980000-0x0000000002981000-memory.dmp
memory/1908-5-0x0000000005610000-0x0000000005611000-memory.dmp
memory/1908-3-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/3116-8-0x0000000000400000-0x000000000040C000-memory.dmp
memory/3116-13-0x0000000073920000-0x000000007400E000-memory.dmp
memory/3116-19-0x0000000005910000-0x0000000005911000-memory.dmp
memory/3116-20-0x0000000005A00000-0x0000000005A01000-memory.dmp
memory/3116-21-0x0000000005890000-0x0000000005891000-memory.dmp