Analysis
-
max time kernel
81s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 15:42
Static task
static1
Behavioral task
behavioral1
Sample
03400b0baec9c5e28a4c8b9a581cea7d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
03400b0baec9c5e28a4c8b9a581cea7d.exe
Resource
win10v2004-20220414-en
General
-
Target
03400b0baec9c5e28a4c8b9a581cea7d.exe
-
Size
500KB
-
MD5
03400b0baec9c5e28a4c8b9a581cea7d
-
SHA1
cac992a233a4e478bf645750fa927f2167bcd0df
-
SHA256
bf8e99aff676c619236dd47399d9a43e8f3afb9df78aa2852f8270ae4870be48
-
SHA512
fa93a4eed519b153fb5d60527ac738163c9c71ca36596acb388c6282cd78c3b2aea1681d926a9dad4576b61780f2afce0b6a141728d39b8da203374117bbc5c8
Malware Config
Extracted
njrat
0.7.3
JUNIO30
verde2020.duckdns.org:7782
Client.exe
-
reg_key
Client.exe
-
splitter
1234
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1976 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
03400b0baec9c5e28a4c8b9a581cea7d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\03400b0baec9c5e28a4c8b9a581cea7d.exe\" .." 03400b0baec9c5e28a4c8b9a581cea7d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\03400b0baec9c5e28a4c8b9a581cea7d.exe\" .." 03400b0baec9c5e28a4c8b9a581cea7d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
03400b0baec9c5e28a4c8b9a581cea7d.exedescription pid process target process PID 1936 set thread context of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
03400b0baec9c5e28a4c8b9a581cea7d.exepid process 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
03400b0baec9c5e28a4c8b9a581cea7d.exe03400b0baec9c5e28a4c8b9a581cea7d.exedescription pid process Token: SeDebugPrivilege 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe Token: SeDebugPrivilege 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe Token: 33 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe Token: SeIncBasePriorityPrivilege 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
03400b0baec9c5e28a4c8b9a581cea7d.exe03400b0baec9c5e28a4c8b9a581cea7d.execmd.exedescription pid process target process PID 1936 wrote to memory of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe PID 1936 wrote to memory of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe PID 1936 wrote to memory of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe PID 1936 wrote to memory of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe PID 1936 wrote to memory of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe PID 1936 wrote to memory of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe PID 1936 wrote to memory of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe PID 1936 wrote to memory of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe PID 1936 wrote to memory of 1196 1936 03400b0baec9c5e28a4c8b9a581cea7d.exe 03400b0baec9c5e28a4c8b9a581cea7d.exe PID 1196 wrote to memory of 1548 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe schtasks.exe PID 1196 wrote to memory of 1548 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe schtasks.exe PID 1196 wrote to memory of 1548 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe schtasks.exe PID 1196 wrote to memory of 1548 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe schtasks.exe PID 1196 wrote to memory of 1976 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe cmd.exe PID 1196 wrote to memory of 1976 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe cmd.exe PID 1196 wrote to memory of 1976 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe cmd.exe PID 1196 wrote to memory of 1976 1196 03400b0baec9c5e28a4c8b9a581cea7d.exe cmd.exe PID 1976 wrote to memory of 1748 1976 cmd.exe PING.EXE PID 1976 wrote to memory of 1748 1976 cmd.exe PING.EXE PID 1976 wrote to memory of 1748 1976 cmd.exe PING.EXE PID 1976 wrote to memory of 1748 1976 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\03400b0baec9c5e28a4c8b9a581cea7d.exe"C:\Users\Admin\AppData\Local\Temp\03400b0baec9c5e28a4c8b9a581cea7d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\03400b0baec9c5e28a4c8b9a581cea7d.exe"C:\Users\Admin\AppData\Local\Temp\03400b0baec9c5e28a4c8b9a581cea7d.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\03400b0baec9c5e28a4c8b9a581cea7d.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 0 -n 24⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1196-69-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1196-60-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1196-67-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1196-65-0x0000000000414E5E-mapping.dmp
-
memory/1196-63-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1196-59-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1196-64-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1196-62-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1548-71-0x0000000000000000-mapping.dmp
-
memory/1748-73-0x0000000000000000-mapping.dmp
-
memory/1936-58-0x00000000004F0000-0x00000000004F6000-memory.dmpFilesize
24KB
-
memory/1936-55-0x00000000002C0000-0x00000000002F0000-memory.dmpFilesize
192KB
-
memory/1936-57-0x00000000006A0000-0x00000000006BA000-memory.dmpFilesize
104KB
-
memory/1936-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1936-54-0x0000000000CE0000-0x0000000000D64000-memory.dmpFilesize
528KB
-
memory/1976-72-0x0000000000000000-mapping.dmp