Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    10-08-2022 11:11

General

  • Target

    03d42b442504337342a1e4a50c1cd6e1.exe

  • Size

    37KB

  • MD5

    03d42b442504337342a1e4a50c1cd6e1

  • SHA1

    8a9a9cb36183a30e7fc72e9202351af3ac673ea1

  • SHA256

    6ba6b4903ea4866951dd17956a816065f37face5a89c72d3878870c67df9ff0c

  • SHA512

    ed65ecef63f80a4c22d4df48c44ae51b75c50f86d22c8492fe992dc6ce68e48f930f89b62afd197b8fd9e3d02e33468e10ded3d807184e0aad5c086f28bad681

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:10809

Mutex

4da733041df828afcc3b187c0133995e

Attributes
  • reg_key

    4da733041df828afcc3b187c0133995e

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03d42b442504337342a1e4a50c1cd6e1.exe
    "C:\Users\Admin\AppData\Local\Temp\03d42b442504337342a1e4a50c1cd6e1.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\System.exe
      "C:\Windows\System.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      • Drops autorun.inf file
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Windows\System.exe" "System.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:1944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System.exe
    Filesize

    37KB

    MD5

    03d42b442504337342a1e4a50c1cd6e1

    SHA1

    8a9a9cb36183a30e7fc72e9202351af3ac673ea1

    SHA256

    6ba6b4903ea4866951dd17956a816065f37face5a89c72d3878870c67df9ff0c

    SHA512

    ed65ecef63f80a4c22d4df48c44ae51b75c50f86d22c8492fe992dc6ce68e48f930f89b62afd197b8fd9e3d02e33468e10ded3d807184e0aad5c086f28bad681

  • C:\Windows\System.exe
    Filesize

    37KB

    MD5

    03d42b442504337342a1e4a50c1cd6e1

    SHA1

    8a9a9cb36183a30e7fc72e9202351af3ac673ea1

    SHA256

    6ba6b4903ea4866951dd17956a816065f37face5a89c72d3878870c67df9ff0c

    SHA512

    ed65ecef63f80a4c22d4df48c44ae51b75c50f86d22c8492fe992dc6ce68e48f930f89b62afd197b8fd9e3d02e33468e10ded3d807184e0aad5c086f28bad681

  • memory/1752-54-0x0000000075F81000-0x0000000075F83000-memory.dmp
    Filesize

    8KB

  • memory/1752-55-0x0000000075000000-0x00000000755AB000-memory.dmp
    Filesize

    5.7MB

  • memory/1752-60-0x0000000075000000-0x00000000755AB000-memory.dmp
    Filesize

    5.7MB

  • memory/1908-56-0x0000000000000000-mapping.dmp
  • memory/1908-61-0x0000000075000000-0x00000000755AB000-memory.dmp
    Filesize

    5.7MB

  • memory/1908-64-0x0000000075000000-0x00000000755AB000-memory.dmp
    Filesize

    5.7MB

  • memory/1944-62-0x0000000000000000-mapping.dmp