Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
08-09-2021 16:37
Static task
static1
Behavioral task
behavioral1
Sample
a7c7bb532823a6e7d4ace596f146c618.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
-
Target
a7c7bb532823a6e7d4ace596f146c618.exe
-
Size
113KB
-
MD5
a7c7bb532823a6e7d4ace596f146c618
-
SHA1
d4ce3acc8b40a6880e5c57c9ec5844643413e312
-
SHA256
64d7d58724fe40787f7fdcb2496f96206c538fb80c14fc8827f4e5af9a5c99c8
-
SHA512
51f14f96d6935f336fd224319b1706f9a6d21251c568292574d564b28741ebae8647cb0fca737073ac763e3bd61a0c751538255671c542859d733494a0a566d9
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
Run RunPE
Attributes
-
splitter
|'|'|
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a7c7bb532823a6e7d4ace596f146c618.exedescription pid process target process PID 4796 set thread context of 4196 4796 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe Token: 33 4196 MSBuild.exe Token: SeIncBasePriorityPrivilege 4196 MSBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a7c7bb532823a6e7d4ace596f146c618.exedescription pid process target process PID 4796 wrote to memory of 4196 4796 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe PID 4796 wrote to memory of 4196 4796 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe PID 4796 wrote to memory of 4196 4796 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe PID 4796 wrote to memory of 4196 4796 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe PID 4796 wrote to memory of 4196 4796 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe PID 4796 wrote to memory of 4196 4796 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe PID 4796 wrote to memory of 4196 4796 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe PID 4796 wrote to memory of 4196 4796 a7c7bb532823a6e7d4ace596f146c618.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7c7bb532823a6e7d4ace596f146c618.exe"C:\Users\Admin\AppData\Local\Temp\a7c7bb532823a6e7d4ace596f146c618.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4196-121-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4196-122-0x000000000040FD1E-mapping.dmp
-
memory/4196-126-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/4196-127-0x0000000005210000-0x000000000570E000-memory.dmpFilesize
5.0MB
-
memory/4196-130-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/4796-116-0x0000000005CF0000-0x0000000005CF1000-memory.dmpFilesize
4KB
-
memory/4796-117-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/4796-118-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/4796-119-0x00000000057F0000-0x0000000005CEE000-memory.dmpFilesize
5.0MB
-
memory/4796-120-0x0000000008FB0000-0x0000000008FB7000-memory.dmpFilesize
28KB