Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
23-12-2021 05:03
General
-
Target
tmp/ecba483f-91b4-48f5-bdb9-4e928a6107c2_w.exe
-
Size
23KB
-
MD5
253c0a7c550a95472eb3e94bdc958597
-
SHA1
7d0c637530af513dfa2beb7106414717520fd38b
-
SHA256
fcfa50ca0d4dcf2bb6e96e7b7a223138068f2d6a458d2630757e3bcbe0684aaa
-
SHA512
c183bda213fb008f8fc431183dbf4b7c1fb70b0bcf423205a3beea0399848ddaa75142692e386d8dfb8e61549b84ed59cb12a39151ae8b49629189f279d389e8
Score
10/10
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp\ecba483f-91b4-48f5-bdb9-4e928a6107c2_w.exe"C:\Users\Admin\AppData\Local\Temp\tmp\ecba483f-91b4-48f5-bdb9-4e928a6107c2_w.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\tmp\ecba483f-91b4-48f5-bdb9-4e928a6107c2_w.exe" "ecba483f-91b4-48f5-bdb9-4e928a6107c2_w.exe" ENABLE2⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
4KB
-