Analysis
- max time kernel
146s - max time network
147s - platform
windows7_x64 - resource
win7-en - submitted
08/09/2021, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
a7c7bb532823a6e7d4ace596f146c618.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
- Target a7c7bb532823a6e7d4ace596f146c618.exe
- Size 113KB
- Sample210908-t4s42aaack
- SHA256 64d7d58724fe40787f7fdcb2496f96206c538fb80c14fc8827f4e5af9a5c99c8
- MD5 a7c7bb532823a6e7d4ace596f146c618
- SHA1 d4ce3acc8b40a6880e5c57c9ec5844643413e312
- SHA512 51f14f96d6935f336fd224319b1706f9a6d21251c568292574d564b28741ebae8647cb0fca737073ac763e3bd61a0c751538255671c542859d733494a0a566d9
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
Run RunPE
Attributes
-
splitter
|'|'|
Signatures
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1936 set thread context of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26 - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe Token: 33 1744 MSBuild.exe Token: SeIncBasePriorityPrivilege 1744 MSBuild.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1936 wrote to memory of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26 PID 1936 wrote to memory of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26 PID 1936 wrote to memory of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26 PID 1936 wrote to memory of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26 PID 1936 wrote to memory of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26 PID 1936 wrote to memory of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26 PID 1936 wrote to memory of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26 PID 1936 wrote to memory of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26 PID 1936 wrote to memory of 1744 1936 a7c7bb532823a6e7d4ace596f146c618.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7c7bb532823a6e7d4ace596f146c618.exe"C:\Users\Admin\AppData\Local\Temp\a7c7bb532823a6e7d4ace596f146c618.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744
-