Overview

overview

10

Static

static

b96d0b747d...bb.exe

windows7_x64

10

b96d0b747d...bb.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 18:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b96d0b747d9ada9349495efee61d8c04beccc4bb7c3ab5ea794a5b0dffd9a5bb.exe

  • Size

    25KB

  • MD5

    61d42a9ef8ab1ae1f90f79ee3f41d7cd

  • SHA1

    9a52b27d80a084e5b69207e97337c36d03ea5b70

  • SHA256

    b96d0b747d9ada9349495efee61d8c04beccc4bb7c3ab5ea794a5b0dffd9a5bb

  • SHA512

    f821d61060ae63d471cc37e04725265424dad82da64dc6b575dbb3c498d461e6fd56cc4243b58b0e5462b4d545baf09c26d1276050bde870a514ddffce3daeac

Score
10/10
suricata

Malware Config

Signatures

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b96d0b747d9ada9349495efee61d8c04beccc4bb7c3ab5ea794a5b0dffd9a5bb.exe
    "C:\Users\Admin\AppData\Local\Temp\b96d0b747d9ada9349495efee61d8c04beccc4bb7c3ab5ea794a5b0dffd9a5bb.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4636-130-0x0000000000E30000-0x0000000000E38000-memory.dmp
    Filesize

    32KB

    Download
  • memory/4636-131-0x00007FFBA4980000-0x00007FFBA5441000-memory.dmp
    Filesize

    10.8MB

    Download