Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06/11/2022, 09:49
General
-
Target
05c6e2475d547bfebcb56aeb53546433a57d27c3e6392b51d8c5f0b3c0f356e0.exe
-
Size
132KB
-
MD5
10c1ced83ce8354b9ffb5d5892e76630
-
SHA1
298dce72815accd9b2ab724004afd9f8dfedfe14
-
SHA256
05c6e2475d547bfebcb56aeb53546433a57d27c3e6392b51d8c5f0b3c0f356e0
-
SHA512
049ab0efba23731df28bd463f9518b8b9183a01c15798c9e7e2dfaabbf1763a65d8133116b639a5a3877ea9112de8c89c7228239c9cc7f91fb2bb2a04213f1eb
-
SSDEEP
3072:pP4y3Ga2xGaDLyXnD3gw98iBymQWx+bTR3I2TdgO:Z0VsaknzZ8iBrLIZ3IIi
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05c6e2475d547bfebcb56aeb53546433a57d27c3e6392b51d8c5f0b3c0f356e0.exe"C:\Users\Admin\AppData\Local\Temp\05c6e2475d547bfebcb56aeb53546433a57d27c3e6392b51d8c5f0b3c0f356e0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\google chrome .exe"C:\Users\Admin\AppData\Local\Temp\google chrome .exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\google chrome .exe" "google chrome .exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD510c1ced83ce8354b9ffb5d5892e76630
SHA1298dce72815accd9b2ab724004afd9f8dfedfe14
SHA25605c6e2475d547bfebcb56aeb53546433a57d27c3e6392b51d8c5f0b3c0f356e0
SHA512049ab0efba23731df28bd463f9518b8b9183a01c15798c9e7e2dfaabbf1763a65d8133116b639a5a3877ea9112de8c89c7228239c9cc7f91fb2bb2a04213f1eb
-
Filesize
132KB
MD510c1ced83ce8354b9ffb5d5892e76630
SHA1298dce72815accd9b2ab724004afd9f8dfedfe14
SHA25605c6e2475d547bfebcb56aeb53546433a57d27c3e6392b51d8c5f0b3c0f356e0
SHA512049ab0efba23731df28bd463f9518b8b9183a01c15798c9e7e2dfaabbf1763a65d8133116b639a5a3877ea9112de8c89c7228239c9cc7f91fb2bb2a04213f1eb
-
Filesize
160KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB