Analysis
-
max time kernel
30s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
-
submitted
21-07-2022 09:43
General
-
Target
Doc Exploit.exe
-
Size
962KB
-
MD5
1daa09b102d6ab7c6018c1eef85b5ede
-
SHA1
f78812012be7b8835a20f304ae23f7b27e1e43f2
-
SHA256
30a1c47c640de86c7a315b94519678372dec89ff78e05690b93cfd180cb66f86
-
SHA512
aa22a9e33e81dca276081b86406594df2aebfc52414f5a86b95f591ed163d7ae77d9012badaf1cacbc3ce7027cc0bae86d66233337eae222c1a13fa24b4ca57e
Malware Config
Extracted
njrat
im523
HacKed
contents-burn.at.playit.gg:50182
5276b1886f2a5c8a7d50871be674198b
-
reg_key
5276b1886f2a5c8a7d50871be674198b
-
splitter
|'|'|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Executes dropped EXE 2 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc Exploit.exe"C:\Users\Admin\AppData\Local\Temp\Doc Exploit.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Explorer.exe"C:\Users\Admin\AppData\Roaming\Explorer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Explorer.exe" "Explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Roaming\Doc.exe"C:\Users\Admin\AppData\Roaming\Doc.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
503KB
MD5c6bf43d4b46a1f80d2393d530a6803f3
SHA16fd8394c4298f217bb00da13ffc3946ed9d7d8b8
SHA2566cbd12e0322d1332c29e3d1e14d9fda173e2ea7f74eb645986b3152dfb9aa348
SHA5120ee229f37a3f45197f45469c83f357a0d240eadede36c1a7aab7a3a1d85692903e6f4d5451764db28bb58323c001c9df6dadf20f0fd30977265a8dd87784418d
-
Filesize
503KB
MD5c6bf43d4b46a1f80d2393d530a6803f3
SHA16fd8394c4298f217bb00da13ffc3946ed9d7d8b8
SHA2566cbd12e0322d1332c29e3d1e14d9fda173e2ea7f74eb645986b3152dfb9aa348
SHA5120ee229f37a3f45197f45469c83f357a0d240eadede36c1a7aab7a3a1d85692903e6f4d5451764db28bb58323c001c9df6dadf20f0fd30977265a8dd87784418d
-
Filesize
88KB
MD547ad4afb1db6f901de4fadf9d579879c
SHA161a35a823cc93b8ae034aeacd0dd33af5c081094
SHA256149f7ab886543e93f5dec6dbac775906ecfa5849649d773befafed1623a67e07
SHA5121362420d440765bd42ef68bd72d2449dc2cac555c5c34eae5b0ea95099b75dc6cfaa809eb7c01a36b9546e0f9a4e7431c63d24b39af5999d90bd009a2bf674e8
-
Filesize
88KB
MD547ad4afb1db6f901de4fadf9d579879c
SHA161a35a823cc93b8ae034aeacd0dd33af5c081094
SHA256149f7ab886543e93f5dec6dbac775906ecfa5849649d773befafed1623a67e07
SHA5121362420d440765bd42ef68bd72d2449dc2cac555c5c34eae5b0ea95099b75dc6cfaa809eb7c01a36b9546e0f9a4e7431c63d24b39af5999d90bd009a2bf674e8
-
Filesize
520KB
-
Filesize
344KB
-
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
984KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
-
Filesize
5.7MB
-
-
Filesize
5.7MB