Overview

overview

10

Static

static

10

eeaeea4dd8...a4.exe

windows7_x64

10

eeaeea4dd8...a4.exe

windows10_x64

10

Analysis

  • max time kernel
    154s
  • max time network
    138s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    08-09-2021 09:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eeaeea4dd8b546df89208106c429bb3b7e9a906bab426e8a2610fe4588c320a4.exe

  • Size

    37KB

  • MD5

    f0e1a89b03abdd826e7c90638f82bd63

  • SHA1

    cd3134167e54900784b4cf6efcafe7bd2bc458ad

  • SHA256

    eeaeea4dd8b546df89208106c429bb3b7e9a906bab426e8a2610fe4588c320a4

  • SHA512

    5274482e4cb77e0acf990d0606333d204be912738bc060e5b6b4094e6be15c02d741b92345e61c6bf090d69a253d9d586352e23f8bf571e053a71bc889719156

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

127.0.0.1,127.0.0.1:3222

Mutex

7e2377223e3439a6407c3c6896272242

Attributes
  • reg_key

    7e2377223e3439a6407c3c6896272242

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeaeea4dd8b546df89208106c429bb3b7e9a906bab426e8a2610fe4588c320a4.exe
    "C:\Users\Admin\AppData\Local\Temp\eeaeea4dd8b546df89208106c429bb3b7e9a906bab426e8a2610fe4588c320a4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Users\Admin\AppData\Local\Temp\cheat.exe
      "C:\Users\Admin\AppData\Local\Temp\cheat.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\cheat.exe" "cheat.exe" ENABLE
        3⤵
          PID:2352

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\cheat.exe
      MD5

      f0e1a89b03abdd826e7c90638f82bd63

      SHA1

      cd3134167e54900784b4cf6efcafe7bd2bc458ad

      SHA256

      eeaeea4dd8b546df89208106c429bb3b7e9a906bab426e8a2610fe4588c320a4

      SHA512

      5274482e4cb77e0acf990d0606333d204be912738bc060e5b6b4094e6be15c02d741b92345e61c6bf090d69a253d9d586352e23f8bf571e053a71bc889719156

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\cheat.exe
      MD5

      f0e1a89b03abdd826e7c90638f82bd63

      SHA1

      cd3134167e54900784b4cf6efcafe7bd2bc458ad

      SHA256

      eeaeea4dd8b546df89208106c429bb3b7e9a906bab426e8a2610fe4588c320a4

      SHA512

      5274482e4cb77e0acf990d0606333d204be912738bc060e5b6b4094e6be15c02d741b92345e61c6bf090d69a253d9d586352e23f8bf571e053a71bc889719156

      Download Submit
    • memory/2184-116-0x0000000000000000-mapping.dmp
      Download
    • memory/2184-119-0x00000000028B0000-0x00000000028B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2352-120-0x0000000000000000-mapping.dmp
      Download
    • memory/3172-115-0x0000000003130000-0x0000000003131000-memory.dmp
      Filesize

      4KB

      Download