Analysis
-
max time kernel
151s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25-11-2022 06:58
General
-
Target
d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264.exe
-
Size
112KB
-
MD5
3119a3e493cf879b4fb602e14e86f043
-
SHA1
ada806fbb5f0d8705fdc51b483b17b854131ddfb
-
SHA256
d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264
-
SHA512
15ba4326731121e4f56e259a29210be6a8537839439a4f6b57e73d6ac369a6dfbe1e6027406532e1ca430381542fd5f572342bb1ad905c0f3d5f4bc3597ceaf8
-
SSDEEP
1536:PInhq8KPbgshva5udpsr3Xgr9p8Xzmv2YhAz3:r8KPbgwva5mpE3XgUQo
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264.exe"C:\Users\Admin\AppData\Local\Temp\d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PES 2014 - Download.exe"C:\Users\Admin\AppData\Local\Temp\PES 2014 - Download.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\PES 2014 - Download.exe" "PES 2014 - Download.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PES 2014 - Download.exeFilesize
112KB
MD53119a3e493cf879b4fb602e14e86f043
SHA1ada806fbb5f0d8705fdc51b483b17b854131ddfb
SHA256d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264
SHA51215ba4326731121e4f56e259a29210be6a8537839439a4f6b57e73d6ac369a6dfbe1e6027406532e1ca430381542fd5f572342bb1ad905c0f3d5f4bc3597ceaf8
-
C:\Users\Admin\AppData\Local\Temp\PES 2014 - Download.exeFilesize
112KB
MD53119a3e493cf879b4fb602e14e86f043
SHA1ada806fbb5f0d8705fdc51b483b17b854131ddfb
SHA256d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264
SHA51215ba4326731121e4f56e259a29210be6a8537839439a4f6b57e73d6ac369a6dfbe1e6027406532e1ca430381542fd5f572342bb1ad905c0f3d5f4bc3597ceaf8
-
memory/2220-138-0x0000000000000000-mapping.dmp
-
memory/3672-132-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/3672-136-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/4916-133-0x0000000000000000-mapping.dmp
-
memory/4916-137-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/4916-139-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB