Analysis
- max time kernel
151s - max time network
161s - platform
windows10_x64 - resource
win10v20210408 - submitted
08/09/2021, 16:37
General
- Target a7c7bb532823a6e7d4ace596f146c618.exe
- Size 113KB
- Sample210908-t4s42aaack
- SHA256 64d7d58724fe40787f7fdcb2496f96206c538fb80c14fc8827f4e5af9a5c99c8
Malware Config
Extracted
-
njrat
-
0.7d
-
Run RunPE
-
splitter
|'|'|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7c7bb532823a6e7d4ace596f146c618.exe"C:\Users\Admin\AppData\Local\Temp\a7c7bb532823a6e7d4ace596f146c618.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4196-121-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4196-126-0x0000000005210000-0x0000000005211000-memory.dmp
memory/4196-127-0x0000000005210000-0x000000000570E000-memory.dmp
memory/4196-130-0x00000000054F0000-0x00000000054F1000-memory.dmp
memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/4796-116-0x0000000005CF0000-0x0000000005CF1000-memory.dmp
memory/4796-117-0x00000000058B0000-0x00000000058B1000-memory.dmp
memory/4796-118-0x0000000005A10000-0x0000000005A11000-memory.dmp
memory/4796-119-0x00000000057F0000-0x0000000005CEE000-memory.dmp
memory/4796-120-0x0000000008FB0000-0x0000000008FB7000-memory.dmp