Analysis
-
max time kernel
155s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 09:39
General
-
Target
9d15d34676bafac07b0e985be55deb963addd933d0c4f595c2b2ffbccb4bb7f3.exe
-
Size
249KB
-
MD5
2517b2a262f7f57afd902da885ad21c0
-
SHA1
129177dd00e4a339852897e995fac3cbd6fd9f24
-
SHA256
9d15d34676bafac07b0e985be55deb963addd933d0c4f595c2b2ffbccb4bb7f3
-
SHA512
24e6b906b5a4cea65a8fbf26a3fc0ae3b73c4b9b04058419f01471624ccdc6b1e9fc645eeca576d94724ad52495d39c85412b7307934812f6f989cf6b45998a4
-
SSDEEP
6144:WZmu7oUcwk61Wj3UonUjvGV4dsk5Ge1nfiKsDizuS:WZ97Zh18UjuVvk5GuaKo
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 34 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d15d34676bafac07b0e985be55deb963addd933d0c4f595c2b2ffbccb4bb7f3.exe"C:\Users\Admin\AppData\Local\Temp\9d15d34676bafac07b0e985be55deb963addd933d0c4f595c2b2ffbccb4bb7f3.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD52517b2a262f7f57afd902da885ad21c0
SHA1129177dd00e4a339852897e995fac3cbd6fd9f24
SHA2569d15d34676bafac07b0e985be55deb963addd933d0c4f595c2b2ffbccb4bb7f3
SHA51224e6b906b5a4cea65a8fbf26a3fc0ae3b73c4b9b04058419f01471624ccdc6b1e9fc645eeca576d94724ad52495d39c85412b7307934812f6f989cf6b45998a4
-
Filesize
249KB
MD52517b2a262f7f57afd902da885ad21c0
SHA1129177dd00e4a339852897e995fac3cbd6fd9f24
SHA2569d15d34676bafac07b0e985be55deb963addd933d0c4f595c2b2ffbccb4bb7f3
SHA51224e6b906b5a4cea65a8fbf26a3fc0ae3b73c4b9b04058419f01471624ccdc6b1e9fc645eeca576d94724ad52495d39c85412b7307934812f6f989cf6b45998a4
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
-
Filesize
5.7MB
-
Filesize
5.7MB