Overview

overview

10

Static

static

97bc8df2ed...b2.exe

windows7-x64

10

97bc8df2ed...b2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2022 14:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    97bc8df2edcb87a49e9dedc6ae7952699276031344d3ed97f06a56273fdcd5b2.exe

  • Size

    240KB

  • MD5

    6a24d3a2c5eff925493a56cf4badfa40

  • SHA1

    d0ac8ce3991435ff4d08eaf214166534c7fedc04

  • SHA256

    97bc8df2edcb87a49e9dedc6ae7952699276031344d3ed97f06a56273fdcd5b2

  • SHA512

    fb6aa516f0f0f85c9f22f54ec0ab8c321bca299b0ee8acfa89267610accd83244d6e8f721f375644f3477d5f0be5bffbb2dc256038ef4b4c42a898dcc2f530d1

  • SSDEEP

    3072:bKXSOyTcwFIvP4/5PWCYzTwuq+O/20nfSyk:bUSOyT2C2Tcur

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

rawaz.no-ip.biz:1177

Mutex

e2938176ad4f8955a927d3a3225a361f

Attributes
  • reg_key

    e2938176ad4f8955a927d3a3225a361f

  • splitter

    |'|'|

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\97bc8df2edcb87a49e9dedc6ae7952699276031344d3ed97f06a56273fdcd5b2.exe
    "C:\Users\Admin\AppData\Local\Temp\97bc8df2edcb87a49e9dedc6ae7952699276031344d3ed97f06a56273fdcd5b2.exe"
    1⤵
    • UAC bypass
    • Drops startup file
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops autorun.inf file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1388
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\System32\svchost.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:368
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UE2GR79L.txt
    Filesize

    608B

    MD5

    061eec074466f358ec2ca3098fb18da4

    SHA1

    97eb8b98cff8a8bf3e9b8ca2245ac003d2dd70dc

    SHA256

    34675876c10682da047010443a02b040865c8da739aaf1443748b1114bb654b4

    SHA512

    10ada86cde2ec5a45bde7b6e02d8525f40f8ec5f4ba8500534517781b4b9981b7b1c2534b508307365628600ea716d9860b1907c6704bcc63c8568cf6f87d62f

    Download Submit
  • memory/368-56-0x0000000000400000-0x000000000040C000-memory.dmp
    Filesize

    48KB

    Download
  • memory/368-57-0x000000000040748E-mapping.dmp
    Download
  • memory/368-59-0x0000000000400000-0x000000000040C000-memory.dmp
    Filesize

    48KB

    Download
  • memory/368-61-0x0000000000400000-0x000000000040C000-memory.dmp
    Filesize

    48KB

    Download
  • memory/1388-54-0x0000000075711000-0x0000000075713000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1388-55-0x0000000074C10000-0x00000000751BB000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1388-63-0x0000000074C10000-0x00000000751BB000-memory.dmp
    Filesize

    5.7MB

    Download