Analysis
-
max time kernel
153s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
30-11-2022 18:51
General
-
Target
b54cbddc24fb9dee08f80d5a163a7fede64a9d0618832238ffcfe92a7659870a.exe
-
Size
39KB
-
MD5
623415373058b612f362b55dcea0a3ac
-
SHA1
637bff768e494b09665ccb3ab6b6d97f915a7020
-
SHA256
b54cbddc24fb9dee08f80d5a163a7fede64a9d0618832238ffcfe92a7659870a
-
SHA512
93a2f746066897542829ca618fd8e611f237256bda05857e4198a49773658a6345e9000c4c666b3480768e88262fa77cb03bf0523477a9ed3c31e5c6a7a4a21d
-
SSDEEP
768:ppD+Zwq3r1uFbaYh+Jnq7az+xRug+n2hpUE+fDNkQp6HwfegB:XD+HZuY5q7az+GgDbUfZkQTfea
Score
10/10
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b54cbddc24fb9dee08f80d5a163a7fede64a9d0618832238ffcfe92a7659870a.exe"C:\Users\Admin\AppData\Local\Temp\b54cbddc24fb9dee08f80d5a163a7fede64a9d0618832238ffcfe92a7659870a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2148-132-0x0000000000F90000-0x0000000000FA0000-memory.dmpFilesize
64KB
-
memory/2148-133-0x0000000005920000-0x00000000059BC000-memory.dmpFilesize
624KB
-
memory/2148-134-0x0000000006170000-0x0000000006714000-memory.dmpFilesize
5.6MB
-
memory/2148-135-0x0000000005DD0000-0x0000000005E62000-memory.dmpFilesize
584KB
-
memory/2148-136-0x0000000006060000-0x000000000606A000-memory.dmpFilesize
40KB