Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 20:44

General

  • Target

    aa0ee111ac78e794300c45a122fbaf42c9ae0b1df9366f9cc62d67ea9f797d31.exe

  • Size

    219KB

  • MD5

    e696169f58b17a5e0ae2f0224b9a863b

  • SHA1

    ba078bc0b91335dec3f7bb87a70fc5bf58190b2c

  • SHA256

    aa0ee111ac78e794300c45a122fbaf42c9ae0b1df9366f9cc62d67ea9f797d31

  • SHA512

    19704abafdacf11fe1bd610125bb257926114c853355722a57b450a3816b04074899ad1fce7f92af9b3212b6bc6a70909aeaec4fa9fcfeab8b746536019a8fff

  • SSDEEP

    6144:wV8xLIQ/j6TIZNhGWaOF33OWSkRgZFRJZi4mm:koMHUHKOxO+RSJZii

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hacked

C2

kissme1988.no-ip.biz:5552

Mutex

dc57475995c921da5a2603cdc0101794

Attributes
  • reg_key

    dc57475995c921da5a2603cdc0101794

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa0ee111ac78e794300c45a122fbaf42c9ae0b1df9366f9cc62d67ea9f797d31.exe
    "C:\Users\Admin\AppData\Local\Temp\aa0ee111ac78e794300c45a122fbaf42c9ae0b1df9366f9cc62d67ea9f797d31.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Users\Admin\AppData\Local\Temp\152.exe
      C:\Users\Admin\AppData\Local\Temp\152.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:392
      • C:\Users\Admin\AppData\Roaming\systemBL.exe
        "C:\Users\Admin\AppData\Roaming\systemBL.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\systemBL.exe" "systemBL.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          PID:3064

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\152.exe

    Filesize

    23KB

    MD5

    9c480814d52d00cddc8a228e3a700175

    SHA1

    e7c78acef70734e8555bbf136cfd2b864ec8f2bf

    SHA256

    d4b79df1194c74f4d7b4d9abfaa78e316835a596881e7145cbaecc197fa2847c

    SHA512

    1e732e2a537ba952febf5be039db77f024afced0886d17fb009098ba730976a1efb03edfa415e730d876bd746778524e76dd31e52786c81fd505c47b83d2a202

  • C:\Users\Admin\AppData\Local\Temp\152.exe

    Filesize

    23KB

    MD5

    9c480814d52d00cddc8a228e3a700175

    SHA1

    e7c78acef70734e8555bbf136cfd2b864ec8f2bf

    SHA256

    d4b79df1194c74f4d7b4d9abfaa78e316835a596881e7145cbaecc197fa2847c

    SHA512

    1e732e2a537ba952febf5be039db77f024afced0886d17fb009098ba730976a1efb03edfa415e730d876bd746778524e76dd31e52786c81fd505c47b83d2a202

  • C:\Users\Admin\AppData\Roaming\systemBL.exe

    Filesize

    23KB

    MD5

    9c480814d52d00cddc8a228e3a700175

    SHA1

    e7c78acef70734e8555bbf136cfd2b864ec8f2bf

    SHA256

    d4b79df1194c74f4d7b4d9abfaa78e316835a596881e7145cbaecc197fa2847c

    SHA512

    1e732e2a537ba952febf5be039db77f024afced0886d17fb009098ba730976a1efb03edfa415e730d876bd746778524e76dd31e52786c81fd505c47b83d2a202

  • C:\Users\Admin\AppData\Roaming\systemBL.exe

    Filesize

    23KB

    MD5

    9c480814d52d00cddc8a228e3a700175

    SHA1

    e7c78acef70734e8555bbf136cfd2b864ec8f2bf

    SHA256

    d4b79df1194c74f4d7b4d9abfaa78e316835a596881e7145cbaecc197fa2847c

    SHA512

    1e732e2a537ba952febf5be039db77f024afced0886d17fb009098ba730976a1efb03edfa415e730d876bd746778524e76dd31e52786c81fd505c47b83d2a202

  • memory/392-138-0x0000000074640000-0x0000000074BF1000-memory.dmp

    Filesize

    5.7MB

  • memory/392-135-0x0000000000000000-mapping.dmp

  • memory/392-144-0x0000000074640000-0x0000000074BF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3064-145-0x0000000000000000-mapping.dmp

  • memory/4344-132-0x0000000000E40000-0x0000000000E7E000-memory.dmp

    Filesize

    248KB

  • memory/4344-134-0x00007FF817550000-0x00007FF818011000-memory.dmp

    Filesize

    10.8MB

  • memory/4344-133-0x00007FF817550000-0x00007FF818011000-memory.dmp

    Filesize

    10.8MB

  • memory/4344-140-0x00007FF817550000-0x00007FF818011000-memory.dmp

    Filesize

    10.8MB

  • memory/4768-139-0x0000000000000000-mapping.dmp

  • memory/4768-143-0x0000000074640000-0x0000000074BF1000-memory.dmp

    Filesize

    5.7MB

  • memory/4768-146-0x0000000074640000-0x0000000074BF1000-memory.dmp

    Filesize

    5.7MB