ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

General
Target

ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe

Filesize

310KB

Completed

22-09-2021 13:28

Score
10 /10
MD5

7d800ad9f415b03e6bb9a029fa57a3ec

SHA1

73d737b77a8fea41dad18dc6cdde0892b0dc9796

SHA256

ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

Malware Config
Signatures 9

Filter: none

Discovery
Persistence
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

  • Executes dropped EXE
    System.exe

    Reported IOCs

    pidprocess
    304System.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Drops startup file
    System.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f65c7a4a4880bc336b681db036e15111.exeSystem.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f65c7a4a4880bc336b681db036e15111.exeSystem.exe
  • Loads dropped DLL
    ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe

    Reported IOCs

    pidprocess
    1540ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe
  • Drops file in Windows directory
    ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.newab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe
    File createdC:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.newab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious use of AdjustPrivilegeToken
    System.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
    Token: 33304System.exe
    Token: SeIncBasePriorityPrivilege304System.exe
  • Suspicious use of WriteProcessMemory
    ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exeSystem.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1540 wrote to memory of 3041540ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exeSystem.exe
    PID 1540 wrote to memory of 3041540ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exeSystem.exe
    PID 1540 wrote to memory of 3041540ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exeSystem.exe
    PID 1540 wrote to memory of 3041540ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exeSystem.exe
    PID 304 wrote to memory of 1136304System.exenetsh.exe
    PID 304 wrote to memory of 1136304System.exenetsh.exe
    PID 304 wrote to memory of 1136304System.exenetsh.exe
    PID 304 wrote to memory of 1136304System.exenetsh.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe
    "C:\Users\Admin\AppData\Local\Temp\ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe"
    Loads dropped DLL
    Drops file in Windows directory
    Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Users\Admin\AppData\Roaming\System.exe
      "C:\Users\Admin\AppData\Roaming\System.exe"
      Executes dropped EXE
      Drops startup file
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:304
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\System.exe" "System.exe" ENABLE
        PID:1136
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Roaming\System.exe

                        MD5

                        7d800ad9f415b03e6bb9a029fa57a3ec

                        SHA1

                        73d737b77a8fea41dad18dc6cdde0892b0dc9796

                        SHA256

                        ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

                        SHA512

                        5549ec9bdf48419ad8edaceb1120ad4c8ccc0ead7057a7349ca40ccd997c70244eb1c102a4f63e03acd76947a76a0456dc00473458c18509b803451779c5bf0a

                      • C:\Users\Admin\AppData\Roaming\System.exe

                        MD5

                        7d800ad9f415b03e6bb9a029fa57a3ec

                        SHA1

                        73d737b77a8fea41dad18dc6cdde0892b0dc9796

                        SHA256

                        ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

                        SHA512

                        5549ec9bdf48419ad8edaceb1120ad4c8ccc0ead7057a7349ca40ccd997c70244eb1c102a4f63e03acd76947a76a0456dc00473458c18509b803451779c5bf0a

                      • \Users\Admin\AppData\Roaming\System.exe

                        MD5

                        7d800ad9f415b03e6bb9a029fa57a3ec

                        SHA1

                        73d737b77a8fea41dad18dc6cdde0892b0dc9796

                        SHA256

                        ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

                        SHA512

                        5549ec9bdf48419ad8edaceb1120ad4c8ccc0ead7057a7349ca40ccd997c70244eb1c102a4f63e03acd76947a76a0456dc00473458c18509b803451779c5bf0a

                      • memory/304-60-0x0000000002020000-0x0000000002021000-memory.dmp

                      • memory/304-56-0x0000000000000000-mapping.dmp

                      • memory/1136-61-0x0000000000000000-mapping.dmp

                      • memory/1540-53-0x0000000075A71000-0x0000000075A73000-memory.dmp

                      • memory/1540-54-0x0000000000540000-0x0000000000541000-memory.dmp