Overview

overview

10

Static

static

59B45EF1DA...D1.exe

windows7_x64

59B45EF1DA...D1.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    05-09-2021 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    59B45EF1DA7D5DD6D2CB29796794FAE90F67F13566DD1.exe

  • Size

    884KB

  • MD5

    c865447ddf5a946a5663c824ec3a8f28

  • SHA1

    dd713980b874a10f6eb1c8e4cf6343e2d28afa8f

  • SHA256

    59b45ef1da7d5dd6d2cb29796794fae90f67f13566dd15864fe4a65e42b9d7b7

  • SHA512

    5238aef22f795be8c1ab5afbae5e5f9f5a3e07880dada27ce353438c147fab09a4f1b51529b391d3dbdffa177120a90af97a1431b7b9b2dc4007a2edfcccc6fb

Score
10/10
njratskypepersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

SKYPE

C2

browserskype.duckdns.org:2024

Mutex

CNAODt.exe

Attributes
  • reg_key

    CNAODt.exe

  • splitter

    zaq1

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59B45EF1DA7D5DD6D2CB29796794FAE90F67F13566DD1.exe
    "C:\Users\Admin\AppData\Local\Temp\59B45EF1DA7D5DD6D2CB29796794FAE90F67F13566DD1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/632-114-0x0000000000650000-0x0000000000651000-memory.dmp
    Filesize

    4KB

    Download
  • memory/632-115-0x0000000002510000-0x0000000002605000-memory.dmp
    Filesize

    980KB

    Download
  • memory/632-116-0x0000000002C40000-0x0000000002D35000-memory.dmp
    Filesize

    980KB

    Download
  • memory/2044-117-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

    Download
  • memory/2044-118-0x000000000040EB5E-mapping.dmp
    Download
  • memory/2044-119-0x0000000000D70000-0x0000000000D71000-memory.dmp
    Filesize

    4KB

    Download