Overview

overview

10

Static

static

10

a56b590f35...6d.exe

windows7_x64

10

a56b590f35...6d.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    153s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    08-05-2022 18:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d.exe

  • Size

    93KB

  • MD5

    acc1465e2be291e70935abc7cf4bd21c

  • SHA1

    f9ddf1b9d275e9b17fed8057eedddda15fef4a4a

  • SHA256

    a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d

  • SHA512

    9173864524173d00839dd518766136537ec82ae2637b6c2fe16788eaba72068fe08dfcbb4e15d9de0c6aa8f2bb1aa025ba2902fe8e7acb8eaad5bed39429f213

Score
10/10
njrathackerevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKer

C2

FRANSESCOjUuFRANSESCOjkuFRANSESCOTFRANSESCOyLjEwNAStrikStrik:MTYwNA==

Mutex

43eaed72e15ff576accb4dc56c41f93d

Attributes
  • reg_key

    43eaed72e15ff576accb4dc56c41f93d

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d.exe
    "C:\Users\Admin\AppData\Local\Temp\a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3376
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3⤵
          PID:1444
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
          3⤵
            PID:4412
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
            3⤵
              PID:1832

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Modify Existing Service

        1
        T1031

        Privilege Escalation

        Defense Evasion

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\server.exe
          Filesize

          93KB

          MD5

          acc1465e2be291e70935abc7cf4bd21c

          SHA1

          f9ddf1b9d275e9b17fed8057eedddda15fef4a4a

          SHA256

          a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d

          SHA512

          9173864524173d00839dd518766136537ec82ae2637b6c2fe16788eaba72068fe08dfcbb4e15d9de0c6aa8f2bb1aa025ba2902fe8e7acb8eaad5bed39429f213

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\server.exe
          Filesize

          93KB

          MD5

          acc1465e2be291e70935abc7cf4bd21c

          SHA1

          f9ddf1b9d275e9b17fed8057eedddda15fef4a4a

          SHA256

          a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d

          SHA512

          9173864524173d00839dd518766136537ec82ae2637b6c2fe16788eaba72068fe08dfcbb4e15d9de0c6aa8f2bb1aa025ba2902fe8e7acb8eaad5bed39429f213

          Download Submit
        • C:\Users\Admin\AppData\Roaming\app
          Filesize

          4B

          MD5

          5fa01e3399c29de16299d5f4ac743fb2

          SHA1

          04e29a03c4a56cf097701f34d6d2999b93035327

          SHA256

          6918b0e9f3af6051db0828a0ec9b353222b84164dab5ed3c85310eefce166223

          SHA512

          5492642165fb12e782f71ba84e8a673ecc047a8a8b3f2f59b64fa8200212326d36ed576fd119ffd0134f1daa03d14069ead81f0e29c2d59de10cdf4bbf2dc90c

          Download Submit
        • memory/1444-136-0x0000000000000000-mapping.dmp
          Download
        • memory/1832-137-0x0000000000000000-mapping.dmp
          Download
        • memory/3376-130-0x0000000075520000-0x0000000075AD1000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/4412-138-0x0000000000000000-mapping.dmp
          Download
        • memory/4580-131-0x0000000000000000-mapping.dmp
          Download
        • memory/4580-135-0x0000000075520000-0x0000000075AD1000-memory.dmp
          Filesize

          5.7MB

          Download