Overview

overview

10

Static

static

10

cfcee11e31...7e.exe

windows7-x64

10

cfcee11e31...7e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2023, 23:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cfcee11e3100662568f6dc68a1058a7e.exe

  • Size

    93KB

  • MD5

    cfcee11e3100662568f6dc68a1058a7e

  • SHA1

    c8662a4be2b73a1e45f54a55bf0c627b9f4965c7

  • SHA256

    3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

  • SHA512

    daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe

  • SSDEEP

    1536:Hm0YeVBvb5Lncb1AG8jEwzGi1dD+DQgS:Hm8Bvb57cBbdi1dY5

Score
10/10
njratloxevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

LOX

C2

NC50Y3AuZXUubmdyb2suaW8Strik:MTc1Mzg=

Mutex

84211ece177abd5f84de6311a704f29d

Attributes
  • reg_key

    84211ece177abd5f84de6311a704f29d

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 1 TTPs 3 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfcee11e3100662568f6dc68a1058a7e.exe
    "C:\Users\Admin\AppData\Local\Temp\cfcee11e3100662568f6dc68a1058a7e.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:676
    • C:\Users\Admin\AppData\Roaming\server.exe
      "C:\Users\Admin\AppData\Roaming\server.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Drops autorun.inf file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3996
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:3596
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:1408
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
        3⤵
        • Modifies Windows Firewall
        PID:448

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\app
    Filesize

    5B

    MD5

    c2844bc9e1bd64168a727b0680ae4d90

    SHA1

    7bb263540de557f5a4e09c6c78b7dbb314a0df9a

    SHA256

    9c9701ab918368b615fc6a0dbeb5efa286a232d751982ae70b48ad6914bf01e5

    SHA512

    360953bb20d91539022fcb1becf4638970c4452816797a8dca65e3ae4a542302e6e89f0828087caaa63a0750aa78605f8034da7c8663fa4fc677c8f3e53655ed

    Download Submit

  • C:\Users\Admin\AppData\Roaming\server.exe
    Filesize

    93KB

    MD5

    cfcee11e3100662568f6dc68a1058a7e

    SHA1

    c8662a4be2b73a1e45f54a55bf0c627b9f4965c7

    SHA256

    3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

    SHA512

    daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe

    Download Submit

  • C:\Users\Admin\AppData\Roaming\server.exe
    Filesize

    93KB

    MD5

    cfcee11e3100662568f6dc68a1058a7e

    SHA1

    c8662a4be2b73a1e45f54a55bf0c627b9f4965c7

    SHA256

    3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

    SHA512

    daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe

    Download Submit

  • C:\Users\Admin\AppData\Roaming\server.exe
    Filesize

    93KB

    MD5

    cfcee11e3100662568f6dc68a1058a7e

    SHA1

    c8662a4be2b73a1e45f54a55bf0c627b9f4965c7

    SHA256

    3b0dd3f9dfc4302b9965dbed206dbd381aef984f1302cfeb9f1709a0fec7f3fc

    SHA512

    daecdf1bd0e4e1d43b64d36c094c9bed135a54aec847510c6b34d8deb4752db9e3a8e8456445b88de3ee0dc354f94f8f3cea9d74bcf73c48d4f9351229e76abe

    Download Submit

  • memory/676-133-0x0000000001330000-0x0000000001340000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-146-0x0000000000D80000-0x0000000000D90000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-152-0x0000000000D80000-0x0000000000D90000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-153-0x0000000000D80000-0x0000000000D90000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3996-154-0x0000000000D80000-0x0000000000D90000-memory.dmp

    Filesize

    64KB

    Download