Analysis

  • max time kernel
    138s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2022, 22:32

General

  • Target

    B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe

  • Size

    747KB

  • MD5

    4f3b19fb5b969de21269ab250ce4f017

  • SHA1

    0df23eb61ff6dc91a5b5bab3d7a5968c37a67ce4

  • SHA256

    b10fddacee9920ac4bd5bfdd19e07124e2830b0974c080ee64abaf9626602be1

  • SHA512

    64afc0a5fa504b903e92183ae3e5e2cfe84a5eb3b61a0b3d568832f47a3c3275e93022907d484f5b78bcaec16a2f56e334bc0a5fef79e977a62ed5c40e2a0b78

  • SSDEEP

    12288:+/PcsxzMIgn3gnBWEGBypwsLjN7WDkAQfYxdEZB8hca3pKp4cI:YFHnBWEGByp5jN7WDzQgdEZB8hcaiG

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

fur1a.duckdns.org:1995

Mutex

bc44c55f6c2c4b43

Attributes
  • reg_key

    bc44c55f6c2c4b43

  • splitter

    @!#&^%$

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe
    "C:\Users\Admin\AppData\Local\Temp\B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WABDXeNNV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5504.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1148
    • C:\Users\Admin\AppData\Local\Temp\B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe
      "C:\Users\Admin\AppData\Local\Temp\B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1288

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp5504.tmp

          Filesize

          1KB

          MD5

          eb24cef2a28d5b5902dc7ec0d6dba1c7

          SHA1

          73dab909e503db0b7ea78e91b04783b8cbaac32f

          SHA256

          0b10887ccecfa33b4194c82b212cb7853cff088ae9609afea6b6c5c0b1f691c1

          SHA512

          4a36bddc329ff5f28d52d4aa78f8c2a50be06ea9713036c5a5f40dc2f37cefe6ec436e88737f082e27cb7e289d7fd4d80cd359be22785042f1551f238e0c4848

        • memory/1092-54-0x0000000010D30000-0x0000000010DF0000-memory.dmp

          Filesize

          768KB

        • memory/1092-55-0x00000000768D1000-0x00000000768D3000-memory.dmp

          Filesize

          8KB

        • memory/1092-56-0x00000000002A0000-0x00000000002AA000-memory.dmp

          Filesize

          40KB

        • memory/1092-57-0x0000000001E70000-0x0000000001EB2000-memory.dmp

          Filesize

          264KB

        • memory/1288-60-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/1288-61-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/1288-63-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/1288-64-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/1288-65-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/1288-68-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/1288-70-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB