Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
06-12-2021 03:21
Static task
static1
Behavioral task
behavioral1
Sample
a16047a43de04f8c9dd254cd39b37421.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a16047a43de04f8c9dd254cd39b37421.exe
Resource
win10-en-20211104
General
-
Target
a16047a43de04f8c9dd254cd39b37421.exe
-
Size
157KB
-
MD5
a16047a43de04f8c9dd254cd39b37421
-
SHA1
50cbe1b1a361fa7adc54c7c75a6d8b9248a889b4
-
SHA256
8859685e5de4d1fdab2dbbfa6899ccb8bbf1b8fb859abf129be79b19b0b87314
-
SHA512
adda28438e09d951ce22cf926eefafc64348a68ff513d82618b98b3c8f1aa4a979f8987861c7f916bcad39a94a5a40c77dad5f3cd91943378335a53c849eb527
Malware Config
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 424 svchost.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e4c9c97604735cc013beb4b9ec9c912.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e4c9c97604735cc013beb4b9ec9c912.exe svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\9e4c9c97604735cc013beb4b9ec9c912 = "\"C:\\Users\\Admin\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9e4c9c97604735cc013beb4b9ec9c912 = "\"C:\\Users\\Admin\\svchost.exe\" .." svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a16047a43de04f8c9dd254cd39b37421.exepid process 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe 3700 a16047a43de04f8c9dd254cd39b37421.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
a16047a43de04f8c9dd254cd39b37421.exesvchost.exedescription pid process Token: SeDebugPrivilege 3700 a16047a43de04f8c9dd254cd39b37421.exe Token: SeDebugPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe Token: 33 424 svchost.exe Token: SeIncBasePriorityPrivilege 424 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a16047a43de04f8c9dd254cd39b37421.exesvchost.exedescription pid process target process PID 3700 wrote to memory of 424 3700 a16047a43de04f8c9dd254cd39b37421.exe svchost.exe PID 3700 wrote to memory of 424 3700 a16047a43de04f8c9dd254cd39b37421.exe svchost.exe PID 3700 wrote to memory of 424 3700 a16047a43de04f8c9dd254cd39b37421.exe svchost.exe PID 424 wrote to memory of 1032 424 svchost.exe netsh.exe PID 424 wrote to memory of 1032 424 svchost.exe netsh.exe PID 424 wrote to memory of 1032 424 svchost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a16047a43de04f8c9dd254cd39b37421.exe"C:\Users\Admin\AppData\Local\Temp\a16047a43de04f8c9dd254cd39b37421.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\svchost.exe"C:\Users\Admin\svchost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\svchost.exe" "svchost.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\svchost.exeMD5
a16047a43de04f8c9dd254cd39b37421
SHA150cbe1b1a361fa7adc54c7c75a6d8b9248a889b4
SHA2568859685e5de4d1fdab2dbbfa6899ccb8bbf1b8fb859abf129be79b19b0b87314
SHA512adda28438e09d951ce22cf926eefafc64348a68ff513d82618b98b3c8f1aa4a979f8987861c7f916bcad39a94a5a40c77dad5f3cd91943378335a53c849eb527
-
C:\Users\Admin\svchost.exeMD5
a16047a43de04f8c9dd254cd39b37421
SHA150cbe1b1a361fa7adc54c7c75a6d8b9248a889b4
SHA2568859685e5de4d1fdab2dbbfa6899ccb8bbf1b8fb859abf129be79b19b0b87314
SHA512adda28438e09d951ce22cf926eefafc64348a68ff513d82618b98b3c8f1aa4a979f8987861c7f916bcad39a94a5a40c77dad5f3cd91943378335a53c849eb527
-
memory/424-119-0x0000000000000000-mapping.dmp
-
memory/424-122-0x0000000002A01000-0x0000000002A02000-memory.dmpFilesize
4KB
-
memory/1032-123-0x0000000000000000-mapping.dmp
-
memory/3700-118-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB