Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
05-12-2022 20:09
General
-
Target
Extreme.Injector.v2.4.5.-.by.master131.exe
-
Size
164KB
-
MD5
2fd45c4572749ca9537fde2dadf1b8dd
-
SHA1
77fce1f2295d640962321c15e628f374525f6689
-
SHA256
f370694edebc6fea374b0ff45057d3d81d697422972c51ec9a27ab531cd39b3b
-
SHA512
7bfae6a212ddd96f58253960d5ddfdb217a1a39674e4927c43637a90466a841229303f080fbbce97e6dc30eb4b1b47909fa965072219ab6b35e7fd86e763a31f
-
SSDEEP
3072:hodc4/cHmSPrcerD+fR6DBBLzy7zRJZGuQkIJ4gRqE2uIE28uEwBZSZbM1hePf:mdHeDtUZabmO
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Executes dropped EXE 1 IoCs
-
Drops startup file 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Extreme.Injector.v2.4.5.-.by.master131.exe"C:\Users\Admin\AppData\Local\Temp\Extreme.Injector.v2.4.5.-.by.master131.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\Extreme.Injector.v2.4.5.-.by.master131.exe" /sc minute /mo 52⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Extreme.Injector.v2.4.5.-.by.master131.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Google Crash Handler.exe"C:\Users\Admin\AppData\Roaming\Google Crash Handler.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Google Crash Handler.exe" /sc minute /mo 53⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Google Crash Handler.exe" /sc minute /mo 13⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {6D23BCC8-4E22-4E78-886D-25D582292D06} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Google Crash Handler.exeFilesize
164KB
MD52fd45c4572749ca9537fde2dadf1b8dd
SHA177fce1f2295d640962321c15e628f374525f6689
SHA256f370694edebc6fea374b0ff45057d3d81d697422972c51ec9a27ab531cd39b3b
SHA5127bfae6a212ddd96f58253960d5ddfdb217a1a39674e4927c43637a90466a841229303f080fbbce97e6dc30eb4b1b47909fa965072219ab6b35e7fd86e763a31f
-
C:\Users\Admin\AppData\Roaming\Google Crash Handler.exeFilesize
164KB
MD52fd45c4572749ca9537fde2dadf1b8dd
SHA177fce1f2295d640962321c15e628f374525f6689
SHA256f370694edebc6fea374b0ff45057d3d81d697422972c51ec9a27ab531cd39b3b
SHA5127bfae6a212ddd96f58253960d5ddfdb217a1a39674e4927c43637a90466a841229303f080fbbce97e6dc30eb4b1b47909fa965072219ab6b35e7fd86e763a31f
-
\Users\Admin\AppData\Roaming\Google Crash Handler.exeFilesize
164KB
MD52fd45c4572749ca9537fde2dadf1b8dd
SHA177fce1f2295d640962321c15e628f374525f6689
SHA256f370694edebc6fea374b0ff45057d3d81d697422972c51ec9a27ab531cd39b3b
SHA5127bfae6a212ddd96f58253960d5ddfdb217a1a39674e4927c43637a90466a841229303f080fbbce97e6dc30eb4b1b47909fa965072219ab6b35e7fd86e763a31f
-
memory/368-58-0x0000000000000000-mapping.dmp
-
memory/536-75-0x00000000000F0000-0x0000000000130000-memory.dmpFilesize
256KB
-
memory/536-74-0x00000000742A0000-0x000000007484B000-memory.dmpFilesize
5.7MB
-
memory/536-73-0x00000000000F0000-0x0000000000130000-memory.dmpFilesize
256KB
-
memory/536-69-0x00000000742A0000-0x000000007484B000-memory.dmpFilesize
5.7MB
-
memory/536-62-0x0000000000000000-mapping.dmp
-
memory/792-72-0x0000000000000000-mapping.dmp
-
memory/824-68-0x0000000000000000-mapping.dmp
-
memory/968-59-0x0000000000000000-mapping.dmp
-
memory/1536-70-0x0000000000000000-mapping.dmp
-
memory/1688-57-0x0000000000000000-mapping.dmp
-
memory/1720-67-0x00000000004C5000-0x00000000004D6000-memory.dmpFilesize
68KB
-
memory/1720-66-0x00000000742A0000-0x000000007484B000-memory.dmpFilesize
5.7MB
-
memory/1720-60-0x00000000004C5000-0x00000000004D6000-memory.dmpFilesize
68KB
-
memory/1720-54-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/1720-56-0x00000000742A0000-0x000000007484B000-memory.dmpFilesize
5.7MB
-
memory/1728-55-0x0000000000000000-mapping.dmp
-
memory/1948-71-0x0000000000000000-mapping.dmp