Analysis
-
max time kernel
202s -
max time network
241s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29-01-2023 18:02
General
-
Target
ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe
-
Size
39KB
-
MD5
03c17cd324c91795ca89512725b6cae9
-
SHA1
2a6b057e8eb399552d7bd61858794fd08f97bcc8
-
SHA256
ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c
-
SHA512
c9f31b717e202b85d3b36a99d96999eb20ad176636875bc9b8dbd199a5c6cc1a5a93466df7917907c6054fed2376f708a76c9b67a9c3d247175b72e36b69640b
-
SSDEEP
768:t2YDGq2S5XOhefd5QahgaTSpZx2neS0Oj2yGlNeO0LR8+wJTpfSvTU:UYiZhe15Xh1TSpb2neSHsNeXLRDw2bU
Score
10/10
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe"C:\Users\Admin\AppData\Local\Temp\ff8b48b672f66d72a084983a589303f6426c951dcf3bbe8521bc5ff9ee56e01c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4876-132-0x0000000000EC0000-0x0000000000ED0000-memory.dmpFilesize
64KB
-
memory/4876-133-0x00000000057A0000-0x000000000583C000-memory.dmpFilesize
624KB
-
memory/4876-134-0x0000000005FF0000-0x0000000006594000-memory.dmpFilesize
5.6MB
-
memory/4876-135-0x0000000001690000-0x0000000001722000-memory.dmpFilesize
584KB
-
memory/4876-136-0x00000000014E0000-0x00000000014EA000-memory.dmpFilesize
40KB