Analysis
-
max time kernel
152s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 09:40
General
-
Target
01292f2d36798d283f69fedb2d99e2d49bcaba70b4e9d0ca29a263f530d27dac.exe
-
Size
432KB
-
MD5
9f8e2a486b7597c426188a6530c10907
-
SHA1
c3f87975be7f7e7639593833a9f569de15909346
-
SHA256
01292f2d36798d283f69fedb2d99e2d49bcaba70b4e9d0ca29a263f530d27dac
-
SHA512
c7ee008af0e94eee737a345201813faf9c5e0dd7db5c5fb254e6c306df32e6794bd698c4feb6f1a9e1dccbfaf2bb07c61e02ceae3463c8e3c1724214b2238658
-
SSDEEP
12288:ygKEX29rzlwBK9lPx/MiTA119tdgUVcwR+45:ygK0MrzmBSlP8Nf
Score
10/10
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01292f2d36798d283f69fedb2d99e2d49bcaba70b4e9d0ca29a263f530d27dac.exe"C:\Users\Admin\AppData\Local\Temp\01292f2d36798d283f69fedb2d99e2d49bcaba70b4e9d0ca29a263f530d27dac.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01292f2d36798d283f69fedb2d99e2d49bcaba70b4e9d0ca29a263f530d27dac.exeC:\Users\Admin\AppData\Local\Temp\01292f2d36798d283f69fedb2d99e2d49bcaba70b4e9d0ca29a263f530d27dac.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4916-133-0x0000000000000000-mapping.dmp
-
memory/4916-134-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4916-135-0x00000000752E0000-0x0000000075891000-memory.dmpFilesize
5.7MB
-
memory/4916-137-0x00000000752E0000-0x0000000075891000-memory.dmpFilesize
5.7MB
-
memory/4940-132-0x00000000752E0000-0x0000000075891000-memory.dmpFilesize
5.7MB
-
memory/4940-136-0x00000000752E0000-0x0000000075891000-memory.dmpFilesize
5.7MB