Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
02-10-2021 03:25
Static task
static1
Behavioral task
behavioral1
Sample
6a5f6fba52919a8f6f8e371284c3458b.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
6a5f6fba52919a8f6f8e371284c3458b.exe
Resource
win10-en-20210920
General
-
Target
6a5f6fba52919a8f6f8e371284c3458b.exe
-
Size
104KB
-
MD5
6a5f6fba52919a8f6f8e371284c3458b
-
SHA1
669cba3048a250fdb53c4a708ae7b92006072942
-
SHA256
bd5fa7ccde2dbc145685b36d66c3c6161e7e780308bd6ec29666139908e7db26
-
SHA512
5bb20db97e23e93a1c4a6e54bc0b13973012e04d71f4b3efd3e5e1ba691fb0d86a6fbd758446ceab7827be9cb790998d432ed4150d6ddbfdf17b7f8314386e13
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
paomarca.duckdns.org:2054
fede6f9724
-
reg_key
fede6f9724
-
splitter
@!#&^%$
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
Processes:
resource yara_rule behavioral2/memory/3464-118-0x0000000001840000-0x000000000185D000-memory.dmp Core1 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6a5f6fba52919a8f6f8e371284c3458b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\file.exe = "C:\\Users\\Admin\\AppData\\Local\\file.exe" 6a5f6fba52919a8f6f8e371284c3458b.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
6a5f6fba52919a8f6f8e371284c3458b.exedescription pid process Token: SeDebugPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: 33 3464 6a5f6fba52919a8f6f8e371284c3458b.exe Token: SeIncBasePriorityPrivilege 3464 6a5f6fba52919a8f6f8e371284c3458b.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3464-115-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/3464-117-0x0000000001890000-0x00000000018B7000-memory.dmpFilesize
156KB
-
memory/3464-118-0x0000000001840000-0x000000000185D000-memory.dmpFilesize
116KB
-
memory/3464-119-0x0000000003A20000-0x0000000003A28000-memory.dmpFilesize
32KB
-
memory/3464-120-0x0000000001880000-0x0000000001882000-memory.dmpFilesize
8KB