Analysis
-
max time kernel
205s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
25-11-2022 08:00
General
-
Target
3fceca06b23324873f12b745a349bdff3567850f40687786c4e4f0aa789efe03.exe
-
Size
131KB
-
MD5
7172970c5f7feaeefea7dce05c77ec99
-
SHA1
d54ab0a54b0eea89ab205f4eefa3455129a3fcd9
-
SHA256
3fceca06b23324873f12b745a349bdff3567850f40687786c4e4f0aa789efe03
-
SHA512
2140f2fe551c1ec6409d6ccf292e9db02f89ac927d3f706925ed7143df73fe04c3e4ab0759125fd22702e62b1b46b0827168ed4716371b873a9ed2176898ff34
-
SSDEEP
1536:0ypZ/A6HjKnbI66LazSel7tRW03TU4+DW8U2qdbsAqO+064RPT515KE6:bqjnbI7OBYwT+DWZsD0bTT
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fceca06b23324873f12b745a349bdff3567850f40687786c4e4f0aa789efe03.exe"C:\Users\Admin\AppData\Local\Temp\3fceca06b23324873f12b745a349bdff3567850f40687786c4e4f0aa789efe03.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Download Counter Strike 1.6.0.exe"C:\Users\Admin\AppData\Local\Temp\Download Counter Strike 1.6.0.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Download Counter Strike 1.6.0.exe" "Download Counter Strike 1.6.0.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Download Counter Strike 1.6.0.exeFilesize
131KB
MD57172970c5f7feaeefea7dce05c77ec99
SHA1d54ab0a54b0eea89ab205f4eefa3455129a3fcd9
SHA2563fceca06b23324873f12b745a349bdff3567850f40687786c4e4f0aa789efe03
SHA5122140f2fe551c1ec6409d6ccf292e9db02f89ac927d3f706925ed7143df73fe04c3e4ab0759125fd22702e62b1b46b0827168ed4716371b873a9ed2176898ff34
-
C:\Users\Admin\AppData\Local\Temp\Download Counter Strike 1.6.0.exeFilesize
131KB
MD57172970c5f7feaeefea7dce05c77ec99
SHA1d54ab0a54b0eea89ab205f4eefa3455129a3fcd9
SHA2563fceca06b23324873f12b745a349bdff3567850f40687786c4e4f0aa789efe03
SHA5122140f2fe551c1ec6409d6ccf292e9db02f89ac927d3f706925ed7143df73fe04c3e4ab0759125fd22702e62b1b46b0827168ed4716371b873a9ed2176898ff34
-
memory/2284-139-0x0000000000000000-mapping.dmp
-
memory/4468-132-0x0000000075280000-0x0000000075831000-memory.dmpFilesize
5.7MB
-
memory/4468-133-0x0000000075280000-0x0000000075831000-memory.dmpFilesize
5.7MB
-
memory/4468-137-0x0000000075280000-0x0000000075831000-memory.dmpFilesize
5.7MB
-
memory/4588-134-0x0000000000000000-mapping.dmp
-
memory/4588-138-0x0000000075280000-0x0000000075831000-memory.dmpFilesize
5.7MB
-
memory/4588-140-0x0000000075280000-0x0000000075831000-memory.dmpFilesize
5.7MB