Analysis
- max time kernel
153s - max time network
161s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/09/2021, 22:12
General
- Target f8ed697e63a97f53801c85a47b5350e3.exe
- Size 646KB
- Sample210906-14l42sbee5
- SHA256 f9ae91e6b312fadf8864035e4e737daf845cd41cd4b9e28e83fe9820277ea925
Malware Config
Extracted
-
njrat
-
0.7NC
-
NYAN CAT
-
pedrobedoya2021.duckdns.org:1980
-
cf13c225ff474d45b
-
reg_key
cf13c225ff474d45b
-
splitter
@!#&^%$
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8ed697e63a97f53801c85a47b5350e3.exe"C:\Users\Admin\AppData\Local\Temp\f8ed697e63a97f53801c85a47b5350e3.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RbgkAODGyxjzXd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE6E6.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/652-123-0x0000000004DB0000-0x0000000004DC0000-memory.dmp
memory/652-125-0x00000000052A0000-0x00000000052D2000-memory.dmp
memory/652-118-0x000000000A770000-0x000000000A771000-memory.dmp
memory/652-119-0x000000000A310000-0x000000000A311000-memory.dmp
memory/652-120-0x0000000004820000-0x0000000004821000-memory.dmp
memory/652-121-0x000000000A270000-0x000000000A271000-memory.dmp
memory/652-117-0x000000000A1D0000-0x000000000A1D1000-memory.dmp
memory/652-122-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/652-124-0x0000000005200000-0x0000000005277000-memory.dmp
memory/652-114-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/652-126-0x0000000005350000-0x0000000005351000-memory.dmp
memory/652-116-0x0000000000F70000-0x0000000000FDE000-memory.dmp
memory/2272-129-0x0000000000400000-0x000000000040C000-memory.dmp
memory/2272-136-0x0000000005000000-0x00000000054FE000-memory.dmp