ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

max time kernel147s
max time network151s
platformwindows10_x64
resourcewin10-en-20210920
submitted22-09-2021 13:24

Report
Files
Registry
Network
Processes
Mutex
Misc

Target

ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe

Filesize

310KB

Completed

22-09-2021 13:28

Score

10^/10

MD5

7d800ad9f415b03e6bb9a029fa57a3ec

SHA1

73d737b77a8fea41dad18dc6cdde0892b0dc9796

SHA256

ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

Discovery

Persistence

njRAT/Bladabindi

Description

Widely used RAT written in .NET.

Tags

trojan njrat
Executes dropped EXE
System.exe

Reported IOCs

pid process

3300 System.exe
Modifies Windows Firewall

Tags

evasion

TTPs

Modify Existing Service

pid	process
3300	System.exe

Drops startup file

System.exe

Reported IOCs

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f65c7a4a4880bc336b681db036e15111.exe	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f65c7a4a4880bc336b681db036e15111.exe	System.exe

Drops file in Windows directory

ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe

Reported IOCs

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe

Enumerates physical storage devices

Description

Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs

System Information Discovery

Suspicious use of AdjustPrivilegeToken

System.exe

Reported IOCs

description	pid	process
Token: SeDebugPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe
Token: 33	3300	System.exe
Token: SeIncBasePriorityPrivilege	3300	System.exe

Suspicious use of WriteProcessMemory

ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exeSystem.exe

Reported IOCs

description	pid	process	target process
PID 4088 wrote to memory of 3300	4088	ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe	System.exe
PID 4088 wrote to memory of 3300	4088	ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe	System.exe
PID 4088 wrote to memory of 3300	4088	ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe	System.exe
PID 3300 wrote to memory of 3664	3300	System.exe	netsh.exe
PID 3300 wrote to memory of 3664	3300	System.exe	netsh.exe
PID 3300 wrote to memory of 3664	3300	System.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe

"C:\Users\Admin\AppData\Local\Temp\ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145.exe"

Drops file in Windows directory
Suspicious use of WriteProcessMemory

PID:4088

C:\Users\Admin\AppData\Roaming\System.exe

"C:\Users\Admin\AppData\Roaming\System.exe"

Executes dropped EXE
Drops startup file
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory

PID:3300

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\System.exe" "System.exe" ENABLE

PID:3664

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

System Information Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Modify Existing Service

Privilege Escalation

00:00 00:00

C:\Users\Admin\AppData\Roaming\System.exe
MD5
7d800ad9f415b03e6bb9a029fa57a3ec

SHA1
73d737b77a8fea41dad18dc6cdde0892b0dc9796

SHA256
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

SHA512
5549ec9bdf48419ad8edaceb1120ad4c8ccc0ead7057a7349ca40ccd997c70244eb1c102a4f63e03acd76947a76a0456dc00473458c18509b803451779c5bf0a

Download Submit
C:\Users\Admin\AppData\Roaming\System.exe
MD5
7d800ad9f415b03e6bb9a029fa57a3ec

SHA1
73d737b77a8fea41dad18dc6cdde0892b0dc9796

SHA256
ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

SHA512
5549ec9bdf48419ad8edaceb1120ad4c8ccc0ead7057a7349ca40ccd997c70244eb1c102a4f63e03acd76947a76a0456dc00473458c18509b803451779c5bf0a

Download Submit
memory/3300-116-0x0000000000000000-mapping.dmp

Download
memory/3300-119-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download
memory/3664-120-0x0000000000000000-mapping.dmp

Download
memory/4088-115-0x0000000002D90000-0x0000000002D91000-memory.dmp

Download

ab5bfb7c642e59a9c8a6f372ee4847bf5cbc9222ba8a4459997e7cd64cb97145

Filter: none

Description

Tags

Reported IOCs

Tags

TTPs

Reported IOCs

Reported IOCs

Description

TTPs

Reported IOCs

Reported IOCs

Title