Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 21:29
Static task
static1
Behavioral task
behavioral1
Sample
#93874654.exe
Resource
win7-en-20211208
General
-
Target
#93874654.exe
-
Size
300.0MB
-
MD5
a7328c9dba8e429ee5e171a661505137
-
SHA1
f637c4df8840fb7cc8fa93e925294145cab91457
-
SHA256
6248199255f4525503101e01e38d60fda27ee9bcc72a74a817dc1d01596d2a9b
-
SHA512
139c83862561881e328084d813509518fa353d07b532549cf93e7bed9151b137a9239b1c8e2162c85e4956bf327efb847a9643177cbf88cde89634779ddb2ca2
Malware Config
Extracted
njrat
1.9
HacKed
Microsoft.Exe
-
reg_key
Microsoft.Exe
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE 1 IoCs
Processes:
Adobe.exepid process 1980 Adobe.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.Exe RegAsm.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.Exe RegAsm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" .." RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" .." RegAsm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
#93874654.exeAdobe.exedescription pid process target process PID 1212 set thread context of 1668 1212 #93874654.exe RegAsm.exe PID 1980 set thread context of 920 1980 Adobe.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2092 schtasks.exe 2220 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
#93874654.exeAdobe.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1212 #93874654.exe Token: SeDebugPrivilege 1980 Adobe.exe Token: SeDebugPrivilege 1668 RegAsm.exe Token: 33 1668 RegAsm.exe Token: SeIncBasePriorityPrivilege 1668 RegAsm.exe Token: 33 1668 RegAsm.exe Token: SeIncBasePriorityPrivilege 1668 RegAsm.exe Token: 33 1668 RegAsm.exe Token: SeIncBasePriorityPrivilege 1668 RegAsm.exe Token: 33 1668 RegAsm.exe Token: SeIncBasePriorityPrivilege 1668 RegAsm.exe Token: 33 1668 RegAsm.exe Token: SeIncBasePriorityPrivilege 1668 RegAsm.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
#93874654.execmd.exeRegAsm.exeAdobe.execmd.exedescription pid process target process PID 1212 wrote to memory of 1668 1212 #93874654.exe RegAsm.exe PID 1212 wrote to memory of 1668 1212 #93874654.exe RegAsm.exe PID 1212 wrote to memory of 1668 1212 #93874654.exe RegAsm.exe PID 1212 wrote to memory of 1668 1212 #93874654.exe RegAsm.exe PID 1212 wrote to memory of 1668 1212 #93874654.exe RegAsm.exe PID 1212 wrote to memory of 1668 1212 #93874654.exe RegAsm.exe PID 1212 wrote to memory of 1668 1212 #93874654.exe RegAsm.exe PID 1212 wrote to memory of 1668 1212 #93874654.exe RegAsm.exe PID 1212 wrote to memory of 2224 1212 #93874654.exe cmd.exe PID 1212 wrote to memory of 2224 1212 #93874654.exe cmd.exe PID 1212 wrote to memory of 2224 1212 #93874654.exe cmd.exe PID 1212 wrote to memory of 1172 1212 #93874654.exe cmd.exe PID 1212 wrote to memory of 1172 1212 #93874654.exe cmd.exe PID 1212 wrote to memory of 1172 1212 #93874654.exe cmd.exe PID 1212 wrote to memory of 1360 1212 #93874654.exe cmd.exe PID 1212 wrote to memory of 1360 1212 #93874654.exe cmd.exe PID 1212 wrote to memory of 1360 1212 #93874654.exe cmd.exe PID 1172 wrote to memory of 2092 1172 cmd.exe schtasks.exe PID 1172 wrote to memory of 2092 1172 cmd.exe schtasks.exe PID 1172 wrote to memory of 2092 1172 cmd.exe schtasks.exe PID 1668 wrote to memory of 2892 1668 RegAsm.exe netsh.exe PID 1668 wrote to memory of 2892 1668 RegAsm.exe netsh.exe PID 1668 wrote to memory of 2892 1668 RegAsm.exe netsh.exe PID 1980 wrote to memory of 920 1980 Adobe.exe RegAsm.exe PID 1980 wrote to memory of 920 1980 Adobe.exe RegAsm.exe PID 1980 wrote to memory of 920 1980 Adobe.exe RegAsm.exe PID 1980 wrote to memory of 920 1980 Adobe.exe RegAsm.exe PID 1980 wrote to memory of 920 1980 Adobe.exe RegAsm.exe PID 1980 wrote to memory of 920 1980 Adobe.exe RegAsm.exe PID 1980 wrote to memory of 920 1980 Adobe.exe RegAsm.exe PID 1980 wrote to memory of 920 1980 Adobe.exe RegAsm.exe PID 1980 wrote to memory of 2492 1980 Adobe.exe cmd.exe PID 1980 wrote to memory of 2492 1980 Adobe.exe cmd.exe PID 1980 wrote to memory of 2492 1980 Adobe.exe cmd.exe PID 1980 wrote to memory of 3040 1980 Adobe.exe cmd.exe PID 1980 wrote to memory of 3040 1980 Adobe.exe cmd.exe PID 1980 wrote to memory of 3040 1980 Adobe.exe cmd.exe PID 1980 wrote to memory of 3732 1980 Adobe.exe cmd.exe PID 1980 wrote to memory of 3732 1980 Adobe.exe cmd.exe PID 1980 wrote to memory of 3732 1980 Adobe.exe cmd.exe PID 3040 wrote to memory of 2220 3040 cmd.exe schtasks.exe PID 3040 wrote to memory of 2220 3040 cmd.exe schtasks.exe PID 3040 wrote to memory of 2220 3040 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\#93874654.exe"C:\Users\Admin\AppData\Local\Temp\#93874654.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Adobe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\#93874654.exe" "C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exeC:\Users\Admin\AppData\Roaming\Adobe\Adobe.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Adobe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exe" "C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exeMD5
a7328c9dba8e429ee5e171a661505137
SHA1f637c4df8840fb7cc8fa93e925294145cab91457
SHA2566248199255f4525503101e01e38d60fda27ee9bcc72a74a817dc1d01596d2a9b
SHA512139c83862561881e328084d813509518fa353d07b532549cf93e7bed9151b137a9239b1c8e2162c85e4956bf327efb847a9643177cbf88cde89634779ddb2ca2
-
C:\Users\Admin\AppData\Roaming\Adobe\Adobe.exeMD5
a7328c9dba8e429ee5e171a661505137
SHA1f637c4df8840fb7cc8fa93e925294145cab91457
SHA2566248199255f4525503101e01e38d60fda27ee9bcc72a74a817dc1d01596d2a9b
SHA512139c83862561881e328084d813509518fa353d07b532549cf93e7bed9151b137a9239b1c8e2162c85e4956bf327efb847a9643177cbf88cde89634779ddb2ca2
-
memory/1212-117-0x0000000005090000-0x00000000050F6000-memory.dmpFilesize
408KB
-
memory/1212-118-0x0000000005690000-0x0000000005B8E000-memory.dmpFilesize
5.0MB
-
memory/1212-122-0x0000000005230000-0x00000000052C2000-memory.dmpFilesize
584KB
-
memory/1212-171-0x00000000051C0000-0x00000000051CA000-memory.dmpFilesize
40KB
-
memory/1212-115-0x0000000001270000-0x0000000001318000-memory.dmpFilesize
672KB
-
memory/1668-190-0x0000000004FF0000-0x000000000508C000-memory.dmpFilesize
624KB
-
memory/1668-173-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1668-231-0x0000000005090000-0x000000000558E000-memory.dmpFilesize
5.0MB
-
memory/1668-232-0x00000000061F0000-0x0000000006208000-memory.dmpFilesize
96KB
-
memory/1980-229-0x0000000000960000-0x0000000000A08000-memory.dmpFilesize
672KB
-
memory/1980-230-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB