Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-05-2022 05:01
Behavioral task
behavioral1
Sample
b1da0aa9e05b36cc0d53409fa8279582.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b1da0aa9e05b36cc0d53409fa8279582.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
b1da0aa9e05b36cc0d53409fa8279582.exe
-
Size
37KB
-
MD5
b1da0aa9e05b36cc0d53409fa8279582
-
SHA1
1ff6a357002708914603a20004516cf0d94141d7
-
SHA256
8b725290e97a3be8c3c8d1b9d463d57a31c09e76ac0321be39d5c408b4d51d3a
-
SHA512
64a173b77776d8eaca092cd8fb310202f83efbb2f83526334c658e0a929d6449b8376ff7f79f38c45b85883a1e78eb65a64b15deb658bc6f0eee1466f6dfdd23
Score
10/10
Malware Config
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
b1da0aa9e05b36cc0d53409fa8279582.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\88489d1083fd6ed1fecee39e01330c6c.exe b1da0aa9e05b36cc0d53409fa8279582.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\88489d1083fd6ed1fecee39e01330c6c.exe b1da0aa9e05b36cc0d53409fa8279582.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b1da0aa9e05b36cc0d53409fa8279582.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\88489d1083fd6ed1fecee39e01330c6c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b1da0aa9e05b36cc0d53409fa8279582.exe\" .." b1da0aa9e05b36cc0d53409fa8279582.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\88489d1083fd6ed1fecee39e01330c6c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b1da0aa9e05b36cc0d53409fa8279582.exe\" .." b1da0aa9e05b36cc0d53409fa8279582.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b1da0aa9e05b36cc0d53409fa8279582.exepid process 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe 4288 b1da0aa9e05b36cc0d53409fa8279582.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
b1da0aa9e05b36cc0d53409fa8279582.exepid process 4288 b1da0aa9e05b36cc0d53409fa8279582.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
b1da0aa9e05b36cc0d53409fa8279582.exedescription pid process Token: SeDebugPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: 33 4288 b1da0aa9e05b36cc0d53409fa8279582.exe Token: SeIncBasePriorityPrivilege 4288 b1da0aa9e05b36cc0d53409fa8279582.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
b1da0aa9e05b36cc0d53409fa8279582.exedescription pid process target process PID 4288 wrote to memory of 756 4288 b1da0aa9e05b36cc0d53409fa8279582.exe netsh.exe PID 4288 wrote to memory of 756 4288 b1da0aa9e05b36cc0d53409fa8279582.exe netsh.exe PID 4288 wrote to memory of 756 4288 b1da0aa9e05b36cc0d53409fa8279582.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1da0aa9e05b36cc0d53409fa8279582.exe"C:\Users\Admin\AppData\Local\Temp\b1da0aa9e05b36cc0d53409fa8279582.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\b1da0aa9e05b36cc0d53409fa8279582.exe" "b1da0aa9e05b36cc0d53409fa8279582.exe" ENABLE2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/756-133-0x0000000000000000-mapping.dmp
-
memory/4288-130-0x00000000747F0000-0x0000000074DA1000-memory.dmpFilesize
5.7MB
-
memory/4288-131-0x00000000735F0000-0x00000000740F0000-memory.dmpFilesize
11.0MB
-
memory/4288-132-0x0000000072D60000-0x0000000073508000-memory.dmpFilesize
7.7MB
-
memory/4288-134-0x00000000747F0000-0x0000000074DA1000-memory.dmpFilesize
5.7MB
-
memory/4288-135-0x00000000735F0000-0x00000000740F0000-memory.dmpFilesize
11.0MB
-
memory/4288-136-0x0000000072D60000-0x0000000073508000-memory.dmpFilesize
7.7MB