Analysis
-
max time kernel
145s -
max time network
177s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-09-2021 09:53
General
-
Target
Web Gallery of Art_September_2021_.bin.exe
-
Size
631KB
-
MD5
ac237aefbf8e53fbf24b8d1d4b70f10a
-
SHA1
58f39a15fbd94565c7e63f0b1023a6fd3e4c94b1
-
SHA256
0313735280c96410eb3eccff1010df754bb5cdb2ae9b8f621e5851fac5cfd6f0
-
SHA512
aec271ca36c8b85999570bab38c9e5fec71f65df90cfd447c81e9c9cb087c251f9ec2dd56e1df30cb8df13ea107f6187c43efd23cba37cc30a1c842958969eee
Malware Config
Extracted
njrat
v2.0
Galary_MON_09_09
37.120.141.158:18892
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Drops startup file 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Web Gallery of Art_September_2021_.bin.exe"C:\Users\Admin\AppData\Local\Temp\Web Gallery of Art_September_2021_.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CuXzoygncixsQn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDE5D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Web Gallery of Art_September_2021_.bin.exe"{path}"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDE5D.tmpMD5
8a5b77821f35af5449475051e8a2fd38
SHA1ac64442bf6d5f01cef992cdb2f0dc9e9f26127c9
SHA256e389dca2eecf9d8c000285f3c226f59e35abc80bea34e0f9e17da1b60fd19e15
SHA5126d23ffaab17e1a1a932e4e8ee9948f1e208134636e9783f1e83e2cd905b710d803929fe04785450569dde723e4d917f7cfa0c3f4e431d38886c26d039b132d2a
-
memory/640-67-0x0000000000000000-mapping.dmp
-
memory/1832-64-0x00000000001F0000-0x00000000001FE000-memory.dmpFilesize
56KB
-
memory/1832-60-0x0000000000A40000-0x0000000000A41000-memory.dmpFilesize
4KB
-
memory/1832-65-0x0000000004810000-0x000000000487F000-memory.dmpFilesize
444KB
-
memory/1832-66-0x0000000000C20000-0x0000000000C3B000-memory.dmpFilesize
108KB
-
memory/1832-63-0x00000000048F0000-0x00000000048F1000-memory.dmpFilesize
4KB
-
memory/1832-62-0x00000000009D0000-0x0000000000A17000-memory.dmpFilesize
284KB
-
memory/1852-69-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1852-70-0x000000000040838E-mapping.dmp
-
memory/1852-71-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1852-73-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1852-74-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB