Analysis

  • max time kernel
    194s
  • max time network
    211s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2022, 16:33

General

  • Target

    العلمي.exe

  • Size

    28KB

  • MD5

    74526b46799abae6166733f30784d73b

  • SHA1

    fc775da0774384e002314dd3b1e49f2c7dbd69d4

  • SHA256

    e935dcd2b982d3b46c39b880c812fbae4b9f73d5542a02839ef5ce48223f2205

  • SHA512

    98d5ea76b48ff8da220f8d2ec414894a09d30713a285b7f14861521d99c574918d4ac1df1b75af73fd5ec82681fd25832f83035833df1d822e902bae4a0dbe27

  • SSDEEP

    384:w9QXpl7dzns8oDw/LRP55/4GWmqDSeXegLGBsbh0w4wlAokw9OhgOL1vYRGOZzjm:wI7Js8oDSJz4wqZXenBKh0p29SgRl0

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

iraqiiraqi.no-ip.biz:99

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\العلمي.exe
    "C:\Users\Admin\AppData\Local\Temp\العلمي.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:204
    • C:\Users\Admin\AppData\Local\Temp\Trojan.exe
      "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:5044

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Trojan.exe

          Filesize

          28KB

          MD5

          74526b46799abae6166733f30784d73b

          SHA1

          fc775da0774384e002314dd3b1e49f2c7dbd69d4

          SHA256

          e935dcd2b982d3b46c39b880c812fbae4b9f73d5542a02839ef5ce48223f2205

          SHA512

          98d5ea76b48ff8da220f8d2ec414894a09d30713a285b7f14861521d99c574918d4ac1df1b75af73fd5ec82681fd25832f83035833df1d822e902bae4a0dbe27

        • C:\Users\Admin\AppData\Local\Temp\Trojan.exe

          Filesize

          28KB

          MD5

          74526b46799abae6166733f30784d73b

          SHA1

          fc775da0774384e002314dd3b1e49f2c7dbd69d4

          SHA256

          e935dcd2b982d3b46c39b880c812fbae4b9f73d5542a02839ef5ce48223f2205

          SHA512

          98d5ea76b48ff8da220f8d2ec414894a09d30713a285b7f14861521d99c574918d4ac1df1b75af73fd5ec82681fd25832f83035833df1d822e902bae4a0dbe27

        • memory/204-132-0x0000000074DD0000-0x0000000075381000-memory.dmp

          Filesize

          5.7MB

        • memory/204-133-0x0000000074DD0000-0x0000000075381000-memory.dmp

          Filesize

          5.7MB

        • memory/204-138-0x0000000074DD0000-0x0000000075381000-memory.dmp

          Filesize

          5.7MB

        • memory/1620-139-0x0000000074DD0000-0x0000000075381000-memory.dmp

          Filesize

          5.7MB

        • memory/1620-140-0x0000000074DD0000-0x0000000075381000-memory.dmp

          Filesize

          5.7MB