Resubmissions
23/06/2024, 02:08
240623-ckph3azank1023/06/2024, 02:06
240623-cjw7hszakr1029/07/2023, 04:14
230729-et59aaah261029/07/2023, 04:14
230729-et1c2aah251029/07/2023, 04:14
230729-etz29sbe6w29/07/2023, 01:12
230729-bkztcsba7110Analysis
- max time kernel
72s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
29/07/2023, 04:14
General
- Target 96e9dcdbf13088adc418ca75982c7b329ea2774b71a74af6d8b55e70162dbd64.exe
- Size 43KB
- Sample230729-et1c2aah25
- SHA256 96e9dcdbf13088adc418ca75982c7b329ea2774b71a74af6d8b55e70162dbd64
Malware Config
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
HacKed
-
2.tcp.eu.ngrok.io:19912
-
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96e9dcdbf13088adc418ca75982c7b329ea2774b71a74af6d8b55e70162dbd64.exe"C:\Users\Admin\AppData\Local\Temp\96e9dcdbf13088adc418ca75982c7b329ea2774b71a74af6d8b55e70162dbd64.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Server.exe
Server.exe
Dllhost.exe
Dllhost.exe
Dllhost.exe
memory/4860-153-0x0000000074420000-0x0000000074BD0000-memory.dmp
memory/4860-150-0x0000000005210000-0x0000000005220000-memory.dmp
memory/4860-156-0x0000000005570000-0x00000000055D6000-memory.dmp
memory/4860-155-0x00000000051F0000-0x00000000051FA000-memory.dmp
memory/4860-154-0x0000000005210000-0x0000000005220000-memory.dmp
memory/4860-149-0x0000000074420000-0x0000000074BD0000-memory.dmp
memory/4916-148-0x0000000074420000-0x0000000074BD0000-memory.dmp
memory/4916-133-0x00000000005C0000-0x00000000005D2000-memory.dmp
memory/4916-138-0x00000000053A0000-0x0000000005432000-memory.dmp
memory/4916-136-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/4916-137-0x00000000058A0000-0x0000000005E44000-memory.dmp
memory/4916-135-0x0000000004F60000-0x0000000004FFC000-memory.dmp
memory/4916-134-0x0000000074420000-0x0000000074BD0000-memory.dmp
memory/4944-159-0x0000000074420000-0x0000000074BD0000-memory.dmp