Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 23:17

General

  • Target

    de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612.exe

  • Size

    29KB

  • MD5

    28250c94c7cfdef4561173fb79c80dd5

  • SHA1

    de82aeb67fada6f57a05519de33b0160b9cb09c7

  • SHA256

    de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612

  • SHA512

    2e707312bff0da419578793f307f65d3c5f97a1c60784855c5c5514a0b6f04d022220ec261794c46fead1488248ec9a8ee26b1c377db6e9d893fec665f6b7e3f

  • SSDEEP

    384:tN2nLNl73t5otQMOdePp5TdNZmGmqD8ZneQqGBsbh0w4wlAokw9OhgOL1vYRGOZ1:tu7jo2MzBvb4qcneQBKh0p29SgR7l

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

rayan100010001000.no-ip.biz:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612.exe
    "C:\Users\Admin\AppData\Local\Temp\de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Users\Admin\AppData\Local\Temp\Trojan.exe
      "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
      2⤵
      • Executes dropped EXE
      PID:3728

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Trojan.exe

    Filesize

    29KB

    MD5

    28250c94c7cfdef4561173fb79c80dd5

    SHA1

    de82aeb67fada6f57a05519de33b0160b9cb09c7

    SHA256

    de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612

    SHA512

    2e707312bff0da419578793f307f65d3c5f97a1c60784855c5c5514a0b6f04d022220ec261794c46fead1488248ec9a8ee26b1c377db6e9d893fec665f6b7e3f

  • C:\Users\Admin\AppData\Local\Temp\Trojan.exe

    Filesize

    29KB

    MD5

    28250c94c7cfdef4561173fb79c80dd5

    SHA1

    de82aeb67fada6f57a05519de33b0160b9cb09c7

    SHA256

    de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612

    SHA512

    2e707312bff0da419578793f307f65d3c5f97a1c60784855c5c5514a0b6f04d022220ec261794c46fead1488248ec9a8ee26b1c377db6e9d893fec665f6b7e3f

  • memory/3728-136-0x00000000752D0000-0x0000000075881000-memory.dmp

    Filesize

    5.7MB

  • memory/3728-138-0x00000000752D0000-0x0000000075881000-memory.dmp

    Filesize

    5.7MB

  • memory/4604-132-0x00000000752D0000-0x0000000075881000-memory.dmp

    Filesize

    5.7MB

  • memory/4604-137-0x00000000752D0000-0x0000000075881000-memory.dmp

    Filesize

    5.7MB