Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
02/03/2023, 21:46
General
-
Target
2953df90d219ace17c42cc15275899dc.exe
-
Size
1.1MB
-
MD5
2953df90d219ace17c42cc15275899dc
-
SHA1
bc42764a515d8b7dfb3a9f98c7f29fbd2b718daf
-
SHA256
cab3b22f726935519d4631ff6a6868b27c84777a6b6b7f13c2ca3e75219e5131
-
SHA512
dd2912f13460aaae250a23c3fb49e4631f81284dbc0126c0f4384b233b58110b342434cf0b439e7ed9e781f64407c7e0fc5fc5ee8cb6e41b57122e6d78c9c0fe
-
SSDEEP
24576:7ApjAeCv5BlblbBfn52l9CfGRHz/X+1WgeSzi+EK/d:7ApjADBK9CgLCWgeSOK1
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2953df90d219ace17c42cc15275899dc.exe"C:\Users\Admin\AppData\Local\Temp\2953df90d219ace17c42cc15275899dc.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\nursultan.exe"C:\Users\Admin\AppData\Roaming\nursultan.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\nursultan.exe" "nursultan.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD52953df90d219ace17c42cc15275899dc
SHA1bc42764a515d8b7dfb3a9f98c7f29fbd2b718daf
SHA256cab3b22f726935519d4631ff6a6868b27c84777a6b6b7f13c2ca3e75219e5131
SHA512dd2912f13460aaae250a23c3fb49e4631f81284dbc0126c0f4384b233b58110b342434cf0b439e7ed9e781f64407c7e0fc5fc5ee8cb6e41b57122e6d78c9c0fe
-
Filesize
1.1MB
MD52953df90d219ace17c42cc15275899dc
SHA1bc42764a515d8b7dfb3a9f98c7f29fbd2b718daf
SHA256cab3b22f726935519d4631ff6a6868b27c84777a6b6b7f13c2ca3e75219e5131
SHA512dd2912f13460aaae250a23c3fb49e4631f81284dbc0126c0f4384b233b58110b342434cf0b439e7ed9e781f64407c7e0fc5fc5ee8cb6e41b57122e6d78c9c0fe
-
Filesize
1.1MB
MD52953df90d219ace17c42cc15275899dc
SHA1bc42764a515d8b7dfb3a9f98c7f29fbd2b718daf
SHA256cab3b22f726935519d4631ff6a6868b27c84777a6b6b7f13c2ca3e75219e5131
SHA512dd2912f13460aaae250a23c3fb49e4631f81284dbc0126c0f4384b233b58110b342434cf0b439e7ed9e781f64407c7e0fc5fc5ee8cb6e41b57122e6d78c9c0fe
-
Filesize
3.4MB
-
Filesize
64KB
-
Filesize
3.4MB
-
Filesize
64KB
-
Filesize
3.4MB
-
Filesize
64KB
-
Filesize
3.4MB