Analysis
- max time kernel
169s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
20/03/2022, 20:21
General
- Target abc159587ddaf37af3b1d7d83de29388.exe
- Size 43KB
- Sample220320-y4zn2affh2
- SHA256 7c321e4c1f7dee37aab2fd65d50987b9502a3700348ef2ab08d79a952ff27ab7
Malware Config
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
HacKed2
-
4.tcp.ngrok.io:19761
-
Windows Update4388
-
reg_key
Windows Update4388
-
splitter
|Hassan|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\abc159587ddaf37af3b1d7d83de29388.exe"C:\Users\Admin\AppData\Local\Temp\abc159587ddaf37af3b1d7d83de29388.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\l444oca32lhost.exe"C:\Users\Admin\l444oca32lhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1572-139-0x00000000053C0000-0x00000000053C1000-memory.dmp
memory/1572-138-0x0000000074440000-0x0000000074BF0000-memory.dmp
memory/1572-140-0x0000000005540000-0x000000000554A000-memory.dmp
memory/1572-141-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/4420-130-0x0000000000520000-0x0000000000532000-memory.dmp
memory/4420-131-0x0000000004D40000-0x0000000004DDC000-memory.dmp
memory/4420-132-0x00000000055E0000-0x0000000005B84000-memory.dmp
memory/4420-133-0x0000000005170000-0x0000000005202000-memory.dmp
memory/4420-134-0x0000000074440000-0x0000000074BF0000-memory.dmp
memory/4420-135-0x0000000004CA0000-0x0000000004D3C000-memory.dmp