b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155

General
Target

b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

Filesize

407KB

Completed

15-09-2021 17:00

Score
10/10
MD5

857aff9992a47764185c61da2493c753

SHA1

6efa34cd3fdb299fcd940c0719d3a172bac83164

SHA256

b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155

Malware Config

Extracted

Family njrat
Version 0.7NC
Botnet NYAN CAT
C2

pedrobedoya2021.duckdns.org:1980

Attributes
reg_key
cf13c225ff474d45b
splitter
@!#&^%$
Signatures 7

Filter: none

Discovery
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    Description

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    Tags

  • Suspicious use of SetThreadContext
    b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3980 set thread context of 35603980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: EnumeratesProcesses
    b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exepowershell.exe

    Reported IOCs

    pidprocess
    3980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    3980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    2904powershell.exe
    2904powershell.exe
    2904powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exepowershell.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege3980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeDebugPrivilege2904powershell.exe
    Token: SeDebugPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: 333560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    Token: SeIncBasePriorityPrivilege3560b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
  • Suspicious use of WriteProcessMemory
    b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3980 wrote to memory of 29043980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exepowershell.exe
    PID 3980 wrote to memory of 29043980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exepowershell.exe
    PID 3980 wrote to memory of 29043980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exepowershell.exe
    PID 3980 wrote to memory of 39723980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 39723980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 39723980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 35603980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 35603980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 35603980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 35603980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 35603980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 35603980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 35603980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    PID 3980 wrote to memory of 35603980b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
    "C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2904
    • C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
      "C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe"
      PID:3972
    • C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
      "C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe"
      Suspicious use of AdjustPrivilegeToken
      PID:3560
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe.log

                          MD5

                          0c2899d7c6746f42d5bbe088c777f94c

                          SHA1

                          622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

                          SHA256

                          5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

                          SHA512

                          ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

                        • memory/2904-144-0x0000000007F40000-0x0000000007F41000-memory.dmp

                        • memory/2904-361-0x0000000009480000-0x0000000009481000-memory.dmp

                        • memory/2904-236-0x0000000000DD3000-0x0000000000DD4000-memory.dmp

                        • memory/2904-235-0x000000007E460000-0x000000007E461000-memory.dmp

                        • memory/2904-166-0x00000000094F0000-0x00000000094F1000-memory.dmp

                        • memory/2904-165-0x0000000009110000-0x0000000009111000-memory.dmp

                        • memory/2904-160-0x0000000008FB0000-0x0000000008FB1000-memory.dmp

                        • memory/2904-153-0x0000000008FD0000-0x0000000009003000-memory.dmp

                        • memory/2904-125-0x0000000000000000-mapping.dmp

                        • memory/2904-143-0x00000000079B0000-0x00000000079B1000-memory.dmp

                        • memory/2904-145-0x00000000081E0000-0x00000000081E1000-memory.dmp

                        • memory/2904-367-0x0000000009470000-0x0000000009471000-memory.dmp

                        • memory/2904-135-0x0000000004730000-0x0000000004731000-memory.dmp

                        • memory/2904-136-0x0000000007200000-0x0000000007201000-memory.dmp

                        • memory/2904-137-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

                        • memory/2904-138-0x0000000000DD2000-0x0000000000DD3000-memory.dmp

                        • memory/2904-139-0x0000000007160000-0x0000000007161000-memory.dmp

                        • memory/2904-140-0x0000000007830000-0x0000000007831000-memory.dmp

                        • memory/2904-141-0x0000000007920000-0x0000000007921000-memory.dmp

                        • memory/2904-142-0x0000000007B70000-0x0000000007B71000-memory.dmp

                        • memory/3560-126-0x0000000000400000-0x000000000040C000-memory.dmp

                        • memory/3560-127-0x000000000040677E-mapping.dmp

                        • memory/3560-383-0x0000000004F30000-0x000000000542E000-memory.dmp

                        • memory/3980-124-0x000000000AE50000-0x000000000AE6F000-memory.dmp

                        • memory/3980-123-0x00000000086A0000-0x00000000086F4000-memory.dmp

                        • memory/3980-122-0x0000000008500000-0x0000000008501000-memory.dmp

                        • memory/3980-121-0x0000000005450000-0x0000000005457000-memory.dmp

                        • memory/3980-120-0x00000000050E0000-0x00000000050E1000-memory.dmp

                        • memory/3980-119-0x0000000004F90000-0x000000000548E000-memory.dmp

                        • memory/3980-118-0x0000000005030000-0x0000000005031000-memory.dmp

                        • memory/3980-117-0x0000000005490000-0x0000000005491000-memory.dmp

                        • memory/3980-115-0x0000000000790000-0x0000000000791000-memory.dmp