Analysis
- max time kernel
207s - max time network
213s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
06/12/2022, 04:43
General
- Target bHFv.exe
- Size 25KB
- Sample221206-fb83wscd8z
- SHA256 f4ddd638a56ab3607b2ecbc00fe2130c0ece91b6e1d5c816b60ae9038ff217ce
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d By Pjoao1578
Botnet
-
HacKed
C2
-
https://pastebin.com/raw/WKEdYjeM:7000
Mutex
-
6a2634340fbf8a0a2c038c6263d49fd1
Attributes
-
reg_key
6a2634340fbf8a0a2c038c6263d49fd1
-
splitter
|'|'|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bHFv.exe"C:\Users\Admin\AppData\Local\Temp\bHFv.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4104-133-0x0000000000B40000-0x0000000000B4C000-memory.dmp
memory/4104-134-0x00000000054C0000-0x000000000555C000-memory.dmp
memory/4104-135-0x0000000005BA0000-0x0000000006144000-memory.dmp
memory/4104-136-0x0000000006730000-0x00000000067C2000-memory.dmp
memory/4104-137-0x0000000006700000-0x000000000670A000-memory.dmp