Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    07-10-2021 04:51

General

  • Target

    DB0031942B3F6B1E7558E8754A068BE14F4FC11000F2E.exe

  • Size

    43KB

  • MD5

    6ef5711bfeba4212669fb6de0969b90f

  • SHA1

    0b8c52c9fe50ae78bee2b0edab9bbd2c7fea54a8

  • SHA256

    db0031942b3f6b1e7558e8754a068be14f4fc11000f2efd1139b985c2438d301

  • SHA512

    c9ccb59c3391059035a450a6d05820238d32e68d0958a68acc8cbb21dac41705da10a01efdeaa340621a18b4e0b9414cb974b8acef3fb76e567683a1cac118cb

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

zombie

C2

zazs.codns.com:8080

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 3 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DB0031942B3F6B1E7558E8754A068BE14F4FC11000F2E.exe
    "C:\Users\Admin\AppData\Local\Temp\DB0031942B3F6B1E7558E8754A068BE14F4FC11000F2E.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
        3⤵
        • Creates scheduled task(s)
        PID:1368
  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    C:\Users\Admin\AppData\Local\Temp/Server.exe
    1⤵
    • Executes dropped EXE
    PID:3864
  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    C:\Users\Admin\AppData\Local\Temp/Server.exe
    1⤵
    • Executes dropped EXE
    PID:368

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.log
    MD5

    7ad3ed2af1de925a18f2d8cb0ea3fddc

    SHA1

    725c8ea78d0493d127493a36c60b359affddcfca

    SHA256

    e32faf8019c289b7fe1ba6db31a6ccc2aaed75953b5953f8f24a6a08cba1f795

    SHA512

    eb423180b7925a62e19f1d612ea007cc4961394a426aac44fc9a4d9085e05ec1686842d8f0eab67c262416caff42b8fe812f6dc3d86372168f262d9bf577ead2

  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    MD5

    6ef5711bfeba4212669fb6de0969b90f

    SHA1

    0b8c52c9fe50ae78bee2b0edab9bbd2c7fea54a8

    SHA256

    db0031942b3f6b1e7558e8754a068be14f4fc11000f2efd1139b985c2438d301

    SHA512

    c9ccb59c3391059035a450a6d05820238d32e68d0958a68acc8cbb21dac41705da10a01efdeaa340621a18b4e0b9414cb974b8acef3fb76e567683a1cac118cb

  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    MD5

    6ef5711bfeba4212669fb6de0969b90f

    SHA1

    0b8c52c9fe50ae78bee2b0edab9bbd2c7fea54a8

    SHA256

    db0031942b3f6b1e7558e8754a068be14f4fc11000f2efd1139b985c2438d301

    SHA512

    c9ccb59c3391059035a450a6d05820238d32e68d0958a68acc8cbb21dac41705da10a01efdeaa340621a18b4e0b9414cb974b8acef3fb76e567683a1cac118cb

  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    MD5

    6ef5711bfeba4212669fb6de0969b90f

    SHA1

    0b8c52c9fe50ae78bee2b0edab9bbd2c7fea54a8

    SHA256

    db0031942b3f6b1e7558e8754a068be14f4fc11000f2efd1139b985c2438d301

    SHA512

    c9ccb59c3391059035a450a6d05820238d32e68d0958a68acc8cbb21dac41705da10a01efdeaa340621a18b4e0b9414cb974b8acef3fb76e567683a1cac118cb

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    MD5

    6ef5711bfeba4212669fb6de0969b90f

    SHA1

    0b8c52c9fe50ae78bee2b0edab9bbd2c7fea54a8

    SHA256

    db0031942b3f6b1e7558e8754a068be14f4fc11000f2efd1139b985c2438d301

    SHA512

    c9ccb59c3391059035a450a6d05820238d32e68d0958a68acc8cbb21dac41705da10a01efdeaa340621a18b4e0b9414cb974b8acef3fb76e567683a1cac118cb

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    MD5

    6ef5711bfeba4212669fb6de0969b90f

    SHA1

    0b8c52c9fe50ae78bee2b0edab9bbd2c7fea54a8

    SHA256

    db0031942b3f6b1e7558e8754a068be14f4fc11000f2efd1139b985c2438d301

    SHA512

    c9ccb59c3391059035a450a6d05820238d32e68d0958a68acc8cbb21dac41705da10a01efdeaa340621a18b4e0b9414cb974b8acef3fb76e567683a1cac118cb

  • memory/368-125-0x0000000002220000-0x0000000002221000-memory.dmp
    Filesize

    4KB

  • memory/804-114-0x0000000002C70000-0x0000000002C71000-memory.dmp
    Filesize

    4KB

  • memory/1056-115-0x0000000000000000-mapping.dmp
  • memory/1056-118-0x0000000003801000-0x0000000003802000-memory.dmp
    Filesize

    4KB

  • memory/1368-119-0x0000000000000000-mapping.dmp
  • memory/3864-122-0x0000000002880000-0x0000000002881000-memory.dmp
    Filesize

    4KB