Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 21:10
Static task
static1
Behavioral task
behavioral1
Sample
njSRC.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
njSRC.exe
Resource
win10-20220414-en
General
-
Target
njSRC.exe
-
Size
72KB
-
MD5
97cb5e5d682b4dabae747fb83f2ab8fd
-
SHA1
865eccfc883ef3df747d8cfc93f0e2dd463ad4e3
-
SHA256
823d633ed0dd6822e1efa314ff214bd9128dd745e787426e1e4d9d781c7a57aa
-
SHA512
ebfcb0fae917c3e055988b6f21454561e17d4e2b5cbe7373a4480ee788117a33b7fdf76482bbef6e8342bdc2751b1459e9624b657dd69849c8d714b74deec9fc
Malware Config
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE 1 IoCs
Processes:
chrome.exepid process 1196 chrome.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
chrome.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\029beef927953d4fdcf3fbf356352119.exe chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\029beef927953d4fdcf3fbf356352119.exe chrome.exe -
Loads dropped DLL 1 IoCs
Processes:
njSRC.exepid process 956 njSRC.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chrome.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\029beef927953d4fdcf3fbf356352119 = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrome.exe\" .." chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\029beef927953d4fdcf3fbf356352119 = "\"C:\\Users\\Admin\\AppData\\Roaming\\chrome.exe\" .." chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
chrome.exedescription pid process Token: SeDebugPrivilege 1196 chrome.exe Token: 33 1196 chrome.exe Token: SeIncBasePriorityPrivilege 1196 chrome.exe Token: 33 1196 chrome.exe Token: SeIncBasePriorityPrivilege 1196 chrome.exe Token: 33 1196 chrome.exe Token: SeIncBasePriorityPrivilege 1196 chrome.exe Token: 33 1196 chrome.exe Token: SeIncBasePriorityPrivilege 1196 chrome.exe Token: 33 1196 chrome.exe Token: SeIncBasePriorityPrivilege 1196 chrome.exe Token: 33 1196 chrome.exe Token: SeIncBasePriorityPrivilege 1196 chrome.exe Token: 33 1196 chrome.exe Token: SeIncBasePriorityPrivilege 1196 chrome.exe Token: 33 1196 chrome.exe Token: SeIncBasePriorityPrivilege 1196 chrome.exe Token: 33 1196 chrome.exe Token: SeIncBasePriorityPrivilege 1196 chrome.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
njSRC.exechrome.exedescription pid process target process PID 956 wrote to memory of 1196 956 njSRC.exe chrome.exe PID 956 wrote to memory of 1196 956 njSRC.exe chrome.exe PID 956 wrote to memory of 1196 956 njSRC.exe chrome.exe PID 956 wrote to memory of 1196 956 njSRC.exe chrome.exe PID 1196 wrote to memory of 1664 1196 chrome.exe netsh.exe PID 1196 wrote to memory of 1664 1196 chrome.exe netsh.exe PID 1196 wrote to memory of 1664 1196 chrome.exe netsh.exe PID 1196 wrote to memory of 1664 1196 chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\njSRC.exe"C:\Users\Admin\AppData\Local\Temp\njSRC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\chrome.exe"C:\Users\Admin\AppData\Roaming\chrome.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\chrome.exe" "chrome.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\chrome.exeFilesize
72KB
MD597cb5e5d682b4dabae747fb83f2ab8fd
SHA1865eccfc883ef3df747d8cfc93f0e2dd463ad4e3
SHA256823d633ed0dd6822e1efa314ff214bd9128dd745e787426e1e4d9d781c7a57aa
SHA512ebfcb0fae917c3e055988b6f21454561e17d4e2b5cbe7373a4480ee788117a33b7fdf76482bbef6e8342bdc2751b1459e9624b657dd69849c8d714b74deec9fc
-
C:\Users\Admin\AppData\Roaming\chrome.exeFilesize
72KB
MD597cb5e5d682b4dabae747fb83f2ab8fd
SHA1865eccfc883ef3df747d8cfc93f0e2dd463ad4e3
SHA256823d633ed0dd6822e1efa314ff214bd9128dd745e787426e1e4d9d781c7a57aa
SHA512ebfcb0fae917c3e055988b6f21454561e17d4e2b5cbe7373a4480ee788117a33b7fdf76482bbef6e8342bdc2751b1459e9624b657dd69849c8d714b74deec9fc
-
\Users\Admin\AppData\Roaming\chrome.exeFilesize
72KB
MD597cb5e5d682b4dabae747fb83f2ab8fd
SHA1865eccfc883ef3df747d8cfc93f0e2dd463ad4e3
SHA256823d633ed0dd6822e1efa314ff214bd9128dd745e787426e1e4d9d781c7a57aa
SHA512ebfcb0fae917c3e055988b6f21454561e17d4e2b5cbe7373a4480ee788117a33b7fdf76482bbef6e8342bdc2751b1459e9624b657dd69849c8d714b74deec9fc
-
memory/956-54-0x00000000763E1000-0x00000000763E3000-memory.dmpFilesize
8KB
-
memory/956-55-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1196-57-0x0000000000000000-mapping.dmp
-
memory/1196-61-0x0000000074980000-0x0000000074F2B000-memory.dmpFilesize
5.7MB
-
memory/1664-62-0x0000000000000000-mapping.dmp