1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f
1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe
152KB
24-09-2021 06:16
c2b9c99086b64ed5ef6ae1bd34288013
43a4fdff438bb03812aaf9cf273c5021a21623f8
1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f
Extracted
| Family | njrat |
| Version | v2.0 |
| Botnet | HacKed |
| C2 |
daddygvgv.ddns.net:1177 |
| Attributes |
reg_key Windows
splitter |-F-| |
Filter: none
-
njRAT/Bladabindi
Description
Widely used RAT written in .NET.
Tags
-
Executes dropped EXEMFhYi.exeMFhYi.exePayload.exe
Reported IOCs
pid process 1352 MFhYi.exe 1544 MFhYi.exe 652 Payload.exe -
Drops startup fileMFhYi.exeMFhYi.exePayload.exe
Reported IOCs
description ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk MFhYi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk MFhYi.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Payload.exe -
Loads dropped DLLMFhYi.exe
Reported IOCs
pid process 1544 MFhYi.exe -
Adds Run key to start applicationMFhYi.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Payload.exe" MFhYi.exe -
Enumerates physical storage devices
Description
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
TTPs
-
Suspicious use of AdjustPrivilegeToken1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exePayload.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe Token: SeDebugPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe -
Suspicious use of WriteProcessMemory1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exeMFhYi.exe
Reported IOCs
description pid process target process PID 2032 wrote to memory of 1352 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1352 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1352 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1352 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1544 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1544 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1544 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1544 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 1544 wrote to memory of 652 1544 MFhYi.exe Payload.exe PID 1544 wrote to memory of 652 1544 MFhYi.exe Payload.exe PID 1544 wrote to memory of 652 1544 MFhYi.exe Payload.exe PID 1544 wrote to memory of 652 1544 MFhYi.exe Payload.exe PID 1544 wrote to memory of 860 1544 MFhYi.exe attrib.exe PID 1544 wrote to memory of 860 1544 MFhYi.exe attrib.exe PID 1544 wrote to memory of 860 1544 MFhYi.exe attrib.exe PID 1544 wrote to memory of 860 1544 MFhYi.exe attrib.exe -
Views/modifies file attributesattrib.exe
Tags
TTPs
Reported IOCs
pid process 860 attrib.exe
-
C:\Users\Admin\AppData\Local\Temp\1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exePID:2032"C:\Users\Admin\AppData\Local\Temp\1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe"Suspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exePID:1352"C:\Users\Admin\AppData\Local\Temp\MFhYi.exe"Executes dropped EXEDrops startup file
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exePID:1544"C:\Users\Admin\AppData\Local\Temp\MFhYi.exe"Executes dropped EXEDrops startup fileLoads dropped DLLAdds Run key to start applicationSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Payload.exePID:652"C:\Users\Admin\AppData\Roaming\Payload.exe"Executes dropped EXEDrops startup fileSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\attrib.exePID:860attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Payload.exe"Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exe
MD58e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exe
MD58e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exe
MD58e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
MD5b9622246a2ed61171999ee678f6cc470
SHA1947ec795fbe97ce8c9b4622b456353716faceefa
SHA256bb8e11992d8f89c50638b95705372a1d5d136784844ccdb98e44ceb79af96056
SHA512102f07473a2ee840f197e8279042b7e5f591d85d238d8ed8a11309f9ed3a6b7f54771a9d163b326ac74f7ac7f411d1114f42e938599ce4d11caaf3cd4b881d1e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
MD5f6cb7b462491f3bd6758b9848a25fa09
SHA113875fca8b81fcc40cff20a9337d04d704adbaac
SHA2568e1c016974f9f54989bacb9ee970508471d3dec83d0938a41c718bee667077df
SHA5123d86c05351743f0ba38e843f4022e2931bede4a273dfd1d257eff420d1329d998f6619209023033d8185743249f0bfd7ff50d0e5cd6bc2b065698aca303727f9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
MD5f6cb7b462491f3bd6758b9848a25fa09
SHA113875fca8b81fcc40cff20a9337d04d704adbaac
SHA2568e1c016974f9f54989bacb9ee970508471d3dec83d0938a41c718bee667077df
SHA5123d86c05351743f0ba38e843f4022e2931bede4a273dfd1d257eff420d1329d998f6619209023033d8185743249f0bfd7ff50d0e5cd6bc2b065698aca303727f9
-
C:\Users\Admin\AppData\Roaming\Payload.exe
MD58e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
C:\Users\Admin\AppData\Roaming\Payload.exe
MD58e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
\Users\Admin\AppData\Roaming\Payload.exe
MD58e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
memory/652-67-0x0000000000000000-mapping.dmp
-
memory/652-74-0x0000000002130000-0x0000000002131000-memory.dmp
-
memory/860-71-0x0000000000000000-mapping.dmp
-
memory/1352-63-0x00000000004C0000-0x00000000004C1000-memory.dmp
-
memory/1352-61-0x00000000759B1000-0x00000000759B3000-memory.dmp
-
memory/1352-56-0x0000000000000000-mapping.dmp
-
memory/1544-64-0x0000000000A20000-0x0000000000A21000-memory.dmp
-
memory/1544-58-0x0000000000000000-mapping.dmp
-
memory/2032-54-0x000000013F940000-0x000000013F941000-memory.dmp