Analysis
- max time kernel
152s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
01/10/2022, 23:03
General
- Target 138851849d5585aa75023fc00340be2ba7c14623329705c2fb9e81f746b3af4e.exe
- Size 90KB
- Sample221001-21nn5scdan
- SHA256 138851849d5585aa75023fc00340be2ba7c14623329705c2fb9e81f746b3af4e
Score
10/10
Malware Config
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Executes dropped EXE 1 IoCs
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\138851849d5585aa75023fc00340be2ba7c14623329705c2fb9e81f746b3af4e.exe"C:\Users\Admin\AppData\Local\Temp\138851849d5585aa75023fc00340be2ba7c14623329705c2fb9e81f746b3af4e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Hack Facebook.exe"C:\Users\Admin\AppData\Local\Temp\Hack Facebook.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Hack Facebook.exe" "Hack Facebook.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Hack Facebook.exe
Hack Facebook.exe
memory/1788-132-0x0000000000F40000-0x0000000000F5C000-memory.dmp
memory/1788-133-0x00000000080A0000-0x000000000813C000-memory.dmp
memory/1788-134-0x00000000087F0000-0x0000000008D94000-memory.dmp
memory/4848-139-0x0000000007E10000-0x0000000007EA2000-memory.dmp
memory/4848-140-0x0000000007DD0000-0x0000000007DDA000-memory.dmp