Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
30/09/2021, 21:22
Behavioral task
behavioral1
Sample
C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe
-
Size
31KB
-
MD5
4adad151f3c235616ce57238c32b4b34
-
SHA1
9d05a045e0ce402ff257d799921a9557a2569535
-
SHA256
c50488a31b6ce8d0ddd65b57bd27cf8c1bc86ad0382476f813c33083c5575d6f
-
SHA512
34b9607899e79f6e381c648f6afde801aed03e4041c9affc13d4855032d139f5164b7f2c4adfea56366d3365dd758fe9c86110b2148cc0c744f04945fc79a366
Score
10/10
Malware Config
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\33aef9319e7f69a68e51dc4a67780130.exe C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\33aef9319e7f69a68e51dc4a67780130.exe C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\33aef9319e7f69a68e51dc4a67780130 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe\" .." C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\33aef9319e7f69a68e51dc4a67780130 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe\" .." C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1132 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 27 PID 1144 wrote to memory of 1132 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 27 PID 1144 wrote to memory of 1132 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 27 PID 1144 wrote to memory of 1132 1144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe"C:\Users\Admin\AppData\Local\Temp\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe" "C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe" ENABLE2⤵PID:1132
-