Overview

overview

10

Static

static

CEB4D88A90...1F.exe

windows7_x64

10

CEB4D88A90...1F.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-09-2021 07:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

  • Size

    170KB

  • MD5

    75b89ea1408de6fdd7429944f8fdbb5e

  • SHA1

    1250d433355aa6d7ce189ea5fe4a9d08df179f18

  • SHA256

    ceb4d88a90ff332d4ea6da16abaf1e04b6296d8618c1f280696acb57cb7bbc68

  • SHA512

    8682bab985ae84c3482328b5e9cb8a60c902e432a9e1ebb58fafd70e31ed0d01303f3dc64c3b6b2b6a8cdce7c9876d18fff133f75844582650177f6be809bf45

Score
10/10
njratcucutaasuricatatrojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

CUCUTAA

C2

noviembre1.duckdns.org:3030

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    lolo

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata
  • Suspicious use of SetThreadContext 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
    "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:568
    • C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
      "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Delete /tn NYAN /F
        3⤵
          PID:1180
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe" /sc minute /mo 1
          3⤵
          • Creates scheduled task(s)
          PID:2972
    • C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
      C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
      1⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
        "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3908
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /tn NYAN /F
          3⤵
            PID:3844
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe" /sc minute /mo 1
            3⤵
            • Creates scheduled task(s)
            PID:2704
      • C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
        C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3676

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe.log
        MD5

        5e7bb97636a484b5a87e60373614279a

        SHA1

        36bfdec32eedb141a4a106d89a453326f62593ee

        SHA256

        12ed6e1df2c57556c59dfd6630fd454a9df76166f340c41ee6bc54d98e709e20

        SHA512

        448c62d538e646045d7315ff902b86f614e2dc1eb0959c22c6618fd2c8767c330d24692357559310e6b55b0c35415a14a6ab2d6d9b8d2a03186949b97190fd56

        Download Submit
      • memory/568-114-0x0000000002610000-0x0000000002611000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1180-118-0x0000000000000000-mapping.dmp
        Download
      • memory/1660-121-0x0000000001220000-0x0000000001221000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2704-126-0x0000000000000000-mapping.dmp
        Download
      • memory/2960-120-0x00000000030F0000-0x00000000030F1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2960-116-0x0000000000414E6E-mapping.dmp
        Download
      • memory/2960-115-0x0000000000400000-0x000000000041A000-memory.dmp
        Filesize

        104KB

        Download
      • memory/2972-119-0x0000000000000000-mapping.dmp
        Download
      • memory/3676-127-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3844-125-0x0000000000000000-mapping.dmp
        Download
      • memory/3908-123-0x0000000000414E6E-mapping.dmp
        Download
      • memory/3908-124-0x00000000028B0000-0x00000000028B1000-memory.dmp
        Filesize

        4KB

        Download