Overview

overview

10

Static

static

10

tmp/bc61a6...er.exe

windows7_x64

10

tmp/bc61a6...er.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    16-12-2021 17:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp/bc61a6f7-5775-425d-9200-2f3e41d4fc52_server.exe

  • Size

    23KB

  • MD5

    f4777ed999fd8352227e750ac0e1b85d

  • SHA1

    fb8c3aa14e4a3bd678bb2ac5fb9d8eaa10f55cd3

  • SHA256

    608a0047a24db367a88e482bef92fd3b9a33db19ad3635b404132202e432eacc

  • SHA512

    4f1f20dce2375392339a3c1ef79ec7708b55b539c949b25655f3a1c749f9cdb875b2f5471c3642b586f6cf28e82caa357fd2d786819acdc6fe6cdef3cba06f80

Score
10/10
njratevasiontrojan

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp\bc61a6f7-5775-425d-9200-2f3e41d4fc52_server.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp\bc61a6f7-5775-425d-9200-2f3e41d4fc52_server.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\tmp\bc61a6f7-5775-425d-9200-2f3e41d4fc52_server.exe" "bc61a6f7-5775-425d-9200-2f3e41d4fc52_server.exe" ENABLE
      2⤵
        PID:1528

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/880-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

      Filesize

      8KB

      Download

    • memory/880-56-0x0000000001F30000-0x0000000001F31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1528-57-0x0000000000000000-mapping.dmp

      Download