Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2022, 22:32

General

  • Target

    B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe

  • Size

    747KB

  • MD5

    4f3b19fb5b969de21269ab250ce4f017

  • SHA1

    0df23eb61ff6dc91a5b5bab3d7a5968c37a67ce4

  • SHA256

    b10fddacee9920ac4bd5bfdd19e07124e2830b0974c080ee64abaf9626602be1

  • SHA512

    64afc0a5fa504b903e92183ae3e5e2cfe84a5eb3b61a0b3d568832f47a3c3275e93022907d484f5b78bcaec16a2f56e334bc0a5fef79e977a62ed5c40e2a0b78

  • SSDEEP

    12288:+/PcsxzMIgn3gnBWEGBypwsLjN7WDkAQfYxdEZB8hca3pKp4cI:YFHnBWEGByp5jN7WDzQgdEZB8hcaiG

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

fur1a.duckdns.org:1995

Mutex

bc44c55f6c2c4b43

Attributes
  • reg_key

    bc44c55f6c2c4b43

  • splitter

    @!#&^%$

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe
    "C:\Users\Admin\AppData\Local\Temp\B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WABDXeNNV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA50.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1360
    • C:\Users\Admin\AppData\Local\Temp\B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe
      "C:\Users\Admin\AppData\Local\Temp\B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1288

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B10FDDACEE9920AC4BD5BFDD19E07124E2830B0974C08.exe.log

          Filesize

          1KB

          MD5

          84e77a587d94307c0ac1357eb4d3d46f

          SHA1

          83cc900f9401f43d181207d64c5adba7a85edc1e

          SHA256

          e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

          SHA512

          aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

        • C:\Users\Admin\AppData\Local\Temp\tmpEA50.tmp

          Filesize

          1KB

          MD5

          c187134c84556e116ba4b771496519c0

          SHA1

          bacba9533d84c26403a0f1634d0b21a9a9b385d4

          SHA256

          cbc00449d3533c143f76ba77e9a6738ab0e979865602af7ea66a7adfa99ade61

          SHA512

          882261af7deb6e4e2eefcab1b2b4ff7e66a1c5b2788b1c643974af4070ca167808610ee7503709658cbe53077dfaa819e3238e414a8e38ca962045a34b4b8176

        • memory/1288-140-0x0000000000400000-0x000000000040C000-memory.dmp

          Filesize

          48KB

        • memory/1288-142-0x0000000005610000-0x0000000005676000-memory.dmp

          Filesize

          408KB

        • memory/4956-132-0x0000000000F80000-0x0000000001040000-memory.dmp

          Filesize

          768KB

        • memory/4956-133-0x0000000005FB0000-0x0000000006554000-memory.dmp

          Filesize

          5.6MB

        • memory/4956-134-0x0000000005A00000-0x0000000005A92000-memory.dmp

          Filesize

          584KB

        • memory/4956-135-0x0000000005AA0000-0x0000000005B3C000-memory.dmp

          Filesize

          624KB

        • memory/4956-136-0x00000000059D0000-0x00000000059DA000-memory.dmp

          Filesize

          40KB