Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
17-09-2022 17:01
General
-
Target
B56D5976D93635974B4BD302578E147064523A1E07AC1.exe
-
Size
313KB
-
MD5
1bf50ad7ee44ebd5d6a12033882ce72c
-
SHA1
40c0674283595b03200bd2d7b46aff240c94193e
-
SHA256
b56d5976d93635974b4bd302578e147064523a1e07ac11c55ba078a16a571fd7
-
SHA512
c14ff25c5b6be262fa2a880051e784945eb7f35523a837ed9ce0bffa4f4652474cb6a28dffd81d8327ae742f7f913d53a82edaf02688893e58fc55057039aa26
-
SSDEEP
3072:7OKkzoKqcD9MBkqtk26R3nQ5u8gXOR4F5/tcoJlPtaWHubKtbCrxdtSQbexk7pi:7KzBqIUb6cgw46Ot0ytbCQQbexkI
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\B56D5976D93635974B4BD302578E147064523A1E07AC1.exe"C:\Users\Admin\AppData\Local\Temp\B56D5976D93635974B4BD302578E147064523A1E07AC1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MicrosoftSilverlighti.exe"C:\Users\Admin\AppData\Roaming\MicrosoftSilverlighti.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\MicrosoftSilverlighti.exe" "MicrosoftSilverlighti.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
313KB
MD51bf50ad7ee44ebd5d6a12033882ce72c
SHA140c0674283595b03200bd2d7b46aff240c94193e
SHA256b56d5976d93635974b4bd302578e147064523a1e07ac11c55ba078a16a571fd7
SHA512c14ff25c5b6be262fa2a880051e784945eb7f35523a837ed9ce0bffa4f4652474cb6a28dffd81d8327ae742f7f913d53a82edaf02688893e58fc55057039aa26
-
Filesize
313KB
MD51bf50ad7ee44ebd5d6a12033882ce72c
SHA140c0674283595b03200bd2d7b46aff240c94193e
SHA256b56d5976d93635974b4bd302578e147064523a1e07ac11c55ba078a16a571fd7
SHA512c14ff25c5b6be262fa2a880051e784945eb7f35523a837ed9ce0bffa4f4652474cb6a28dffd81d8327ae742f7f913d53a82edaf02688893e58fc55057039aa26
-
Filesize
10.2MB
-
Filesize
10.2MB