Overview

overview

10

Static

static

10

acc62c054d...29.exe

windows7_x64

10

acc62c054d...29.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    05-11-2021 19:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    acc62c054d469dbe939843e3fbcc5729.exe

  • Size

    37KB

  • MD5

    acc62c054d469dbe939843e3fbcc5729

  • SHA1

    5c4fa46477f91209fb64130a5051dd2e144f46af

  • SHA256

    8ec51c13cf8a2342bdd735e69a10f3dfc2f2fe5b64d4b1c0f1573afcdde5b123

  • SHA512

    bc1e5b05a71c0e624f6bdffa7b2a56693ce5a1dbc050713549ef6dc239dba3bcdfcbf67a588d3bbe62406bb000541873d4ef76481a43175d46f530dcc2a3afe0

Score
10/10
evasionsuricata

Malware Config

Signatures

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\acc62c054d469dbe939843e3fbcc5729.exe
    "C:\Users\Admin\AppData\Local\Temp\acc62c054d469dbe939843e3fbcc5729.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\acc62c054d469dbe939843e3fbcc5729.exe" "acc62c054d469dbe939843e3fbcc5729.exe" ENABLE
      2⤵
        PID:572

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Modify Existing Service

    1
    T1031

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/572-57-0x0000000000000000-mapping.dmp
      Download
    • memory/1408-55-0x0000000075C51000-0x0000000075C53000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1408-56-0x0000000000170000-0x0000000000171000-memory.dmp
      Filesize

      4KB

      Download