Analysis
- max time kernel
158s - max time network
167s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
16/02/2022, 21:32
General
- Target 89A78C3F2CCFBDFB0413E0D0A193263F2963761A2D817.exe
- Size 80KB
- Sample220216-1dmb5aeeej
- SHA256 89a78c3f2ccfbdfb0413e0d0a193263f2963761a2d817831a56aab4528bb1caa
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
- Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\89A78C3F2CCFBDFB0413E0D0A193263F2963761A2D817.exe"C:\Users\Admin\AppData\Local\Temp\89A78C3F2CCFBDFB0413E0D0A193263F2963761A2D817.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1796-55-0x0000000074591000-0x0000000074592000-memory.dmp
memory/1796-56-0x0000000075831000-0x0000000075833000-memory.dmp
memory/1796-58-0x0000000074592000-0x0000000074594000-memory.dmp
memory/1796-57-0x0000000001FC0000-0x0000000001FC1000-memory.dmp