Analysis
-
max time kernel
174s -
max time network
179s -
platform
windows7_x64 -
resource
win7-en -
submitted
08-09-2021 14:17
Static task
static1
Behavioral task
behavioral1
Sample
32EB5402577CC2CF237816B597A6C466E63E373791561.exe
Resource
win7-en
General
-
Target
32EB5402577CC2CF237816B597A6C466E63E373791561.exe
-
Size
369KB
-
MD5
66bf6c9129b65e59e7f84d5f5e9f58c7
-
SHA1
ada2de51f38ef11260874ee9ba1a5154ed8d2975
-
SHA256
32eb5402577cc2cf237816b597a6c466e63e373791561cd74040e6569694ef91
-
SHA512
f25c90c253ba7c7b3bec89d5231c27a1c70d6ed8abc87681df4cccf633bc7c9a2af8c2d8103a05be920cc02d3a28c58ea3933e29d4780824cbc6568b381b7d3b
Malware Config
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE 2 IoCs
Processes:
taskmngr.exetaskmngr.exepid process 1732 taskmngr.exe 1548 taskmngr.exe -
Drops startup file 2 IoCs
Processes:
taskmngr.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\56afb7245a64d18d5f362ec6edce9740.exe taskmngr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\56afb7245a64d18d5f362ec6edce9740.exe taskmngr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
taskmngr.exedescription pid process Token: SeDebugPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe Token: 33 1548 taskmngr.exe Token: SeIncBasePriorityPrivilege 1548 taskmngr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
32EB5402577CC2CF237816B597A6C466E63E373791561.exetaskmngr.exedescription pid process target process PID 1984 wrote to memory of 1732 1984 32EB5402577CC2CF237816B597A6C466E63E373791561.exe taskmngr.exe PID 1984 wrote to memory of 1732 1984 32EB5402577CC2CF237816B597A6C466E63E373791561.exe taskmngr.exe PID 1984 wrote to memory of 1732 1984 32EB5402577CC2CF237816B597A6C466E63E373791561.exe taskmngr.exe PID 1732 wrote to memory of 1548 1732 taskmngr.exe taskmngr.exe PID 1732 wrote to memory of 1548 1732 taskmngr.exe taskmngr.exe PID 1732 wrote to memory of 1548 1732 taskmngr.exe taskmngr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32EB5402577CC2CF237816B597A6C466E63E373791561.exe"C:\Users\Admin\AppData\Local\Temp\32EB5402577CC2CF237816B597A6C466E63E373791561.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\taskmngr.exe"C:\Users\Admin\AppData\Local\Temp\taskmngr.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\taskmngr.exe"C:\Users\Admin\AppData\Roaming\taskmngr.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\taskmngr.exeMD5
efd9ba2dcf07cb74c861946ea1e0d941
SHA10b19adddd86438fa0bfae27363462eb7aaa061bc
SHA2564a18f29fdce4f3815b160e0dbcbb169d22c681a65341694497f8a121a6723e07
SHA512af3c3b499329ff3fb3486618e9babff143a43f052eaabac3adc5c0cb796a288b559627f714663b5e6545f7e022bc7cf126b198f18ed9506ac13eb86adc4d5ffd
-
C:\Users\Admin\AppData\Local\Temp\taskmngr.exeMD5
efd9ba2dcf07cb74c861946ea1e0d941
SHA10b19adddd86438fa0bfae27363462eb7aaa061bc
SHA2564a18f29fdce4f3815b160e0dbcbb169d22c681a65341694497f8a121a6723e07
SHA512af3c3b499329ff3fb3486618e9babff143a43f052eaabac3adc5c0cb796a288b559627f714663b5e6545f7e022bc7cf126b198f18ed9506ac13eb86adc4d5ffd
-
C:\Users\Admin\AppData\Roaming\taskmngr.exeMD5
efd9ba2dcf07cb74c861946ea1e0d941
SHA10b19adddd86438fa0bfae27363462eb7aaa061bc
SHA2564a18f29fdce4f3815b160e0dbcbb169d22c681a65341694497f8a121a6723e07
SHA512af3c3b499329ff3fb3486618e9babff143a43f052eaabac3adc5c0cb796a288b559627f714663b5e6545f7e022bc7cf126b198f18ed9506ac13eb86adc4d5ffd
-
C:\Users\Admin\AppData\Roaming\taskmngr.exeMD5
efd9ba2dcf07cb74c861946ea1e0d941
SHA10b19adddd86438fa0bfae27363462eb7aaa061bc
SHA2564a18f29fdce4f3815b160e0dbcbb169d22c681a65341694497f8a121a6723e07
SHA512af3c3b499329ff3fb3486618e9babff143a43f052eaabac3adc5c0cb796a288b559627f714663b5e6545f7e022bc7cf126b198f18ed9506ac13eb86adc4d5ffd
-
memory/1548-61-0x0000000000000000-mapping.dmp
-
memory/1548-64-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/1548-65-0x000007FEF3DB0000-0x000007FEF4E46000-memory.dmpFilesize
16.6MB
-
memory/1548-66-0x0000000000366000-0x0000000000385000-memory.dmpFilesize
124KB
-
memory/1732-58-0x0000000000B00000-0x0000000000B02000-memory.dmpFilesize
8KB
-
memory/1732-60-0x000007FEF47E0000-0x000007FEF5876000-memory.dmpFilesize
16.6MB
-
memory/1732-55-0x0000000000000000-mapping.dmp
-
memory/1984-59-0x0000000000320000-0x0000000000322000-memory.dmpFilesize
8KB
-
memory/1984-53-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB