Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    29-03-2021 06:13

General

  • Target

    OrderRequest29032021_BituChemLtd.exe

  • Size

    363KB

  • MD5

    5668a086e3c47ec9cdb8c02b36fd3395

  • SHA1

    263b69b49ad9ab8237f706f91f42ff889d939f61

  • SHA256

    4b1cbc04c8e1b83928148304d772cbf7c55b7aaedf520720b2bf2a6a77fd34a3

  • SHA512

    12d8b17d413cbe4fd3853f548db9984175c0d90385b2ea6b9b6ba37672ae90f31f44f33ac242654e144a54806eab08ce6b43da7581b6daf5e6a2e3decfa41c7e

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

2021$$$

C2

194.5.98.210:4040

Mutex

0ef5de3f5b1fb89677ba03e41fa0a05a

Attributes
  • reg_key

    0ef5de3f5b1fb89677ba03e41fa0a05a

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OrderRequest29032021_BituChemLtd.exe
    "C:\Users\Admin\AppData\Local\Temp\OrderRequest29032021_BituChemLtd.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
      "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe" "AddInProcess32.exe" ENABLE
        3⤵
          PID:776

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
      MD5

      6a673bfc3b67ae9782cb31af2f234c68

      SHA1

      7544e89566d91e84e3cd437b9a073e5f6b56566e

      SHA256

      978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

      SHA512

      72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

    • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
      MD5

      6a673bfc3b67ae9782cb31af2f234c68

      SHA1

      7544e89566d91e84e3cd437b9a073e5f6b56566e

      SHA256

      978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

      SHA512

      72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

    • \Users\Admin\AppData\Local\Temp\AddInProcess32.exe
      MD5

      6a673bfc3b67ae9782cb31af2f234c68

      SHA1

      7544e89566d91e84e3cd437b9a073e5f6b56566e

      SHA256

      978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

      SHA512

      72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

    • memory/776-20-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
      Filesize

      8KB

    • memory/776-19-0x0000000000000000-mapping.dmp
    • memory/1016-12-0x0000000000400000-0x000000000040A000-memory.dmp
      Filesize

      40KB

    • memory/1016-13-0x000000000040747E-mapping.dmp
    • memory/1016-16-0x0000000074120000-0x000000007480E000-memory.dmp
      Filesize

      6.9MB

    • memory/1016-17-0x0000000000400000-0x000000000040A000-memory.dmp
      Filesize

      40KB

    • memory/1016-21-0x0000000004D80000-0x0000000004D81000-memory.dmp
      Filesize

      4KB

    • memory/1728-9-0x00000000007A0000-0x00000000007A1000-memory.dmp
      Filesize

      4KB

    • memory/1728-11-0x00000000003B1000-0x00000000003B2000-memory.dmp
      Filesize

      4KB

    • memory/1728-2-0x0000000074120000-0x000000007480E000-memory.dmp
      Filesize

      6.9MB

    • memory/1728-8-0x0000000000780000-0x000000000078B000-memory.dmp
      Filesize

      44KB

    • memory/1728-7-0x0000000004C90000-0x0000000004CBF000-memory.dmp
      Filesize

      188KB

    • memory/1728-5-0x00000000003B0000-0x00000000003B1000-memory.dmp
      Filesize

      4KB

    • memory/1728-3-0x0000000000810000-0x0000000000811000-memory.dmp
      Filesize

      4KB