Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 21:14
Behavioral task
behavioral1
Sample
a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe
-
Size
31KB
-
MD5
16f2cf1676d0f3c0333c84076f4faf3e
-
SHA1
96f11640dd583e5b5121370ad6b133d214d7e6ec
-
SHA256
a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198
-
SHA512
51167837d0b0ec1662fbc9b4f41c1e5fcee392442474305680a215997d8f8aaa77fb640e470203f60dce400cc8f440526bdc4745083642748038dae0d7800cf3
Malware Config
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Modifies Windows Firewall 1 TTPs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exepid process 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exedescription pid process Token: SeDebugPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: 33 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe Token: SeIncBasePriorityPrivilege 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exedescription pid process target process PID 1016 wrote to memory of 784 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe netsh.exe PID 1016 wrote to memory of 784 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe netsh.exe PID 1016 wrote to memory of 784 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe netsh.exe PID 1016 wrote to memory of 784 1016 a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe"C:\Users\Admin\AppData\Local\Temp\a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe" "a86a64ee1ff4cc5480d383d7496a29208d59af9acb1835f1572f25bcd4e50198.exe" ENABLE2⤵