Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
-
submitted
20-07-2022 11:23
General
-
Target
0335549dd5d1118a7f7d5f27cb3580df.exe
-
Size
23KB
-
MD5
0335549dd5d1118a7f7d5f27cb3580df
-
SHA1
e7e04abff7b927035413384fec50f96fd5c4bf13
-
SHA256
d261f3a5a6b1dbedde2e566d010b71ce3bdb9162942945f8f701b6a3dffbc136
-
SHA512
a62cac6e2eb2d6e2f5b88c92bd0692cd12b49f604ccdca885a557426ff1fde13112c6fd5997421d0023063918f42f8d6e760af3085bc7dc5fa7734bef61348ca
Malware Config
Extracted
njrat
0.7d
HacKed
spk.accesscam.org:55554
8b74397fe4c6a2e2f2b0ca227328ea9d
-
reg_key
8b74397fe4c6a2e2f2b0ca227328ea9d
-
splitter
|'|'|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0335549dd5d1118a7f7d5f27cb3580df.exe"C:\Users\Admin\AppData\Local\Temp\0335549dd5d1118a7f7d5f27cb3580df.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\GyfSg.exe"C:\Users\Admin\AppData\Roaming\GyfSg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\GyfSg.exe" "GyfSg.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD50335549dd5d1118a7f7d5f27cb3580df
SHA1e7e04abff7b927035413384fec50f96fd5c4bf13
SHA256d261f3a5a6b1dbedde2e566d010b71ce3bdb9162942945f8f701b6a3dffbc136
SHA512a62cac6e2eb2d6e2f5b88c92bd0692cd12b49f604ccdca885a557426ff1fde13112c6fd5997421d0023063918f42f8d6e760af3085bc7dc5fa7734bef61348ca
-
Filesize
23KB
MD50335549dd5d1118a7f7d5f27cb3580df
SHA1e7e04abff7b927035413384fec50f96fd5c4bf13
SHA256d261f3a5a6b1dbedde2e566d010b71ce3bdb9162942945f8f701b6a3dffbc136
SHA512a62cac6e2eb2d6e2f5b88c92bd0692cd12b49f604ccdca885a557426ff1fde13112c6fd5997421d0023063918f42f8d6e760af3085bc7dc5fa7734bef61348ca
-
Filesize
23KB
MD50335549dd5d1118a7f7d5f27cb3580df
SHA1e7e04abff7b927035413384fec50f96fd5c4bf13
SHA256d261f3a5a6b1dbedde2e566d010b71ce3bdb9162942945f8f701b6a3dffbc136
SHA512a62cac6e2eb2d6e2f5b88c92bd0692cd12b49f604ccdca885a557426ff1fde13112c6fd5997421d0023063918f42f8d6e760af3085bc7dc5fa7734bef61348ca
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
-
Filesize
5.7MB
-
Filesize
5.7MB