Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    06-11-2021 13:36

General

  • Target

    1A8CD081624ACF2E77C9851F2E223E6542971749ABECC.exe

  • Size

    162KB

  • MD5

    46aafec84dd26ba8e4676b91e7a33b1c

  • SHA1

    7b0041322232fb0776c7fec31914049e0f980427

  • SHA256

    1a8cd081624acf2e77c9851f2e223e6542971749abecc20029d290ffd40fccde

  • SHA512

    c136b4745ce1febc97d691a4b0261412cda6a64e0110989bb37938af77cbdd84eb92ac239af29e11172566c6b759cc35bde43845b5f52209f73baeda14a754c6

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1A8CD081624ACF2E77C9851F2E223E6542971749ABECC.exe
    "C:\Users\Admin\AppData\Local\Temp\1A8CD081624ACF2E77C9851F2E223E6542971749ABECC.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Users\Admin\AppData\Roaming\Y9cA8bTK55jM6Vs2u1ah.exe
      "C:\Users\Admin\AppData\Roaming\Y9cA8bTK55jM6Vs2u1ah.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Users\Admin\AppData\Roaming\internet.exe
        "C:\Users\Admin\AppData\Roaming\internet.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\internet.exe" "internet.exe" ENABLE
          4⤵
            PID:1196

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Y9cA8bTK55jM6Vs2u1ah.exe
      MD5

      43095f8e16dcbb0edc3135fb938e7f97

      SHA1

      dfbe3d053c76582e4f8bc4376da2fe366f0eea04

      SHA256

      414959b916a5536e997ccc5c762fd7fadaad4a3447ce56a0e1ed26fa797e7169

      SHA512

      1f74296ce3da87ab08f1581e698f39c772e1da5d89def5f5b429e4d8cdce03b8fb3354c7f79870bb728e6bfe23cce34a7f11c3b7401bf46f376914d6ccf9e515

    • C:\Users\Admin\AppData\Roaming\Y9cA8bTK55jM6Vs2u1ah.exe
      MD5

      43095f8e16dcbb0edc3135fb938e7f97

      SHA1

      dfbe3d053c76582e4f8bc4376da2fe366f0eea04

      SHA256

      414959b916a5536e997ccc5c762fd7fadaad4a3447ce56a0e1ed26fa797e7169

      SHA512

      1f74296ce3da87ab08f1581e698f39c772e1da5d89def5f5b429e4d8cdce03b8fb3354c7f79870bb728e6bfe23cce34a7f11c3b7401bf46f376914d6ccf9e515

    • C:\Users\Admin\AppData\Roaming\internet.exe
      MD5

      43095f8e16dcbb0edc3135fb938e7f97

      SHA1

      dfbe3d053c76582e4f8bc4376da2fe366f0eea04

      SHA256

      414959b916a5536e997ccc5c762fd7fadaad4a3447ce56a0e1ed26fa797e7169

      SHA512

      1f74296ce3da87ab08f1581e698f39c772e1da5d89def5f5b429e4d8cdce03b8fb3354c7f79870bb728e6bfe23cce34a7f11c3b7401bf46f376914d6ccf9e515

    • C:\Users\Admin\AppData\Roaming\internet.exe
      MD5

      43095f8e16dcbb0edc3135fb938e7f97

      SHA1

      dfbe3d053c76582e4f8bc4376da2fe366f0eea04

      SHA256

      414959b916a5536e997ccc5c762fd7fadaad4a3447ce56a0e1ed26fa797e7169

      SHA512

      1f74296ce3da87ab08f1581e698f39c772e1da5d89def5f5b429e4d8cdce03b8fb3354c7f79870bb728e6bfe23cce34a7f11c3b7401bf46f376914d6ccf9e515

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch
      MD5

      d9fa34a408b0271bbde549e6be6226a0

      SHA1

      fbe59c4051e3707b9f33a9251f410678d2ef0fbb

      SHA256

      db9d4e5b496d7c2bb869af17952d51d66f04d01aa05fc185a31a7cba2bd9413c

      SHA512

      36405d93bc152515f83dec16df1a65c94db48efc41638ecf166dd5eeb6792f8a795f075efd310377902033f0da07a1409cb4553a927f820d0b3860ffb6006f85

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
      MD5

      d9fa34a408b0271bbde549e6be6226a0

      SHA1

      fbe59c4051e3707b9f33a9251f410678d2ef0fbb

      SHA256

      db9d4e5b496d7c2bb869af17952d51d66f04d01aa05fc185a31a7cba2bd9413c

      SHA512

      36405d93bc152515f83dec16df1a65c94db48efc41638ecf166dd5eeb6792f8a795f075efd310377902033f0da07a1409cb4553a927f820d0b3860ffb6006f85

    • \Users\Admin\AppData\Roaming\Y9cA8bTK55jM6Vs2u1ah.exe
      MD5

      43095f8e16dcbb0edc3135fb938e7f97

      SHA1

      dfbe3d053c76582e4f8bc4376da2fe366f0eea04

      SHA256

      414959b916a5536e997ccc5c762fd7fadaad4a3447ce56a0e1ed26fa797e7169

      SHA512

      1f74296ce3da87ab08f1581e698f39c772e1da5d89def5f5b429e4d8cdce03b8fb3354c7f79870bb728e6bfe23cce34a7f11c3b7401bf46f376914d6ccf9e515

    • \Users\Admin\AppData\Roaming\Y9cA8bTK55jM6Vs2u1ah.exe
      MD5

      43095f8e16dcbb0edc3135fb938e7f97

      SHA1

      dfbe3d053c76582e4f8bc4376da2fe366f0eea04

      SHA256

      414959b916a5536e997ccc5c762fd7fadaad4a3447ce56a0e1ed26fa797e7169

      SHA512

      1f74296ce3da87ab08f1581e698f39c772e1da5d89def5f5b429e4d8cdce03b8fb3354c7f79870bb728e6bfe23cce34a7f11c3b7401bf46f376914d6ccf9e515

    • \Users\Admin\AppData\Roaming\internet.exe
      MD5

      43095f8e16dcbb0edc3135fb938e7f97

      SHA1

      dfbe3d053c76582e4f8bc4376da2fe366f0eea04

      SHA256

      414959b916a5536e997ccc5c762fd7fadaad4a3447ce56a0e1ed26fa797e7169

      SHA512

      1f74296ce3da87ab08f1581e698f39c772e1da5d89def5f5b429e4d8cdce03b8fb3354c7f79870bb728e6bfe23cce34a7f11c3b7401bf46f376914d6ccf9e515

    • \Users\Admin\AppData\Roaming\internet.exe
      MD5

      43095f8e16dcbb0edc3135fb938e7f97

      SHA1

      dfbe3d053c76582e4f8bc4376da2fe366f0eea04

      SHA256

      414959b916a5536e997ccc5c762fd7fadaad4a3447ce56a0e1ed26fa797e7169

      SHA512

      1f74296ce3da87ab08f1581e698f39c772e1da5d89def5f5b429e4d8cdce03b8fb3354c7f79870bb728e6bfe23cce34a7f11c3b7401bf46f376914d6ccf9e515

    • memory/744-55-0x0000000076A21000-0x0000000076A23000-memory.dmp
      Filesize

      8KB

    • memory/744-56-0x0000000000D40000-0x0000000000D41000-memory.dmp
      Filesize

      4KB

    • memory/1004-66-0x0000000000000000-mapping.dmp
    • memory/1004-72-0x0000000000320000-0x0000000000321000-memory.dmp
      Filesize

      4KB

    • memory/1196-73-0x0000000000000000-mapping.dmp
    • memory/1472-63-0x0000000002250000-0x0000000002251000-memory.dmp
      Filesize

      4KB

    • memory/1472-59-0x0000000000000000-mapping.dmp