Analysis

  • max time kernel
    152s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2023 22:17

General

  • Target

    1e39c64ba850b0298ab04b9e9c2f69fc.exe

  • Size

    402KB

  • MD5

    1e39c64ba850b0298ab04b9e9c2f69fc

  • SHA1

    1e5f7671e54aa8597ffb3af7fb13e2d0aeaee318

  • SHA256

    5ca60c222235db8fcffbd475e7ed5a8d477e7ad251c30c289de58f743750f2e3

  • SHA512

    e849cd145f019820b188868c04b3b01bf0f072695350b6fc69025831a68c368979ae7a5756f72a13f7903305dbe1df6fac6f993c63921ff6c32b541580a989b8

  • SSDEEP

    6144:zmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgl:oSmLAuEY71fviagATFmebVQDcYc5

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

pdf

C2

hhhmach.ddns.net:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e39c64ba850b0298ab04b9e9c2f69fc.exe
    "C:\Users\Admin\AppData\Local\Temp\1e39c64ba850b0298ab04b9e9c2f69fc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 240
      2⤵
      • Program crash
      PID:4944
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c test.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Users\Admin\AppData\Local\Temp\test.exe
        test.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3688
        • C:\Users\Admin\AppData\Local\Temp\Trojan.exe
          "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 164
      2⤵
      • Program crash
      PID:2612
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3424 -ip 3424
    1⤵
      PID:2484
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
      1⤵
      • Modifies Windows Firewall
      PID:3040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3424 -ip 3424
      1⤵
        PID:4184

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Trojan.exe

        Filesize

        68KB

        MD5

        657473de097114583ea97fc3df887639

        SHA1

        5994425d0bf4d69dcf5ee43f8014ddc7ec611bfd

        SHA256

        ad3bc3688e0693c553f57980434dd829c9c8a39923b32771c0834db545774387

        SHA512

        9658d35aa5e7b8df84ac3cd03f7331ddf3e4bb5ff8ec9815916a1b8ec3c6fc7e128d920b69b708604525ff04fd12432bf0971b3e44976468d89813753da6143f

      • C:\Users\Admin\AppData\Local\Temp\test.exe

        Filesize

        78KB

        MD5

        42c5854aa0709d8bf6c28ea82c67b9a5

        SHA1

        124ea473f0572009de85a4a46f361109f4fae7d6

        SHA256

        71e1add662041fee9ff0ddf0139154cf006538559af45f34047aac91efb1b8eb

        SHA512

        c0f4412f2237138b5b66ecc285d7f44bacd67ae23feb0a55561cd4f7850ee6b0fd1b1dac3d2725ed4932aaf155b0fbda284a69b07594789bdb4cbcf0f499d95a

      • memory/2248-24-0x00000000011F0000-0x0000000001200000-memory.dmp

        Filesize

        64KB

      • memory/2248-25-0x00000000011F0000-0x0000000001200000-memory.dmp

        Filesize

        64KB

      • memory/2248-29-0x00000000011F0000-0x0000000001200000-memory.dmp

        Filesize

        64KB

      • memory/2248-28-0x00000000011F0000-0x0000000001200000-memory.dmp

        Filesize

        64KB

      • memory/2248-27-0x00000000011F0000-0x0000000001200000-memory.dmp

        Filesize

        64KB

      • memory/2248-20-0x0000000074DA0000-0x0000000075351000-memory.dmp

        Filesize

        5.7MB

      • memory/2248-19-0x00000000011F0000-0x0000000001200000-memory.dmp

        Filesize

        64KB

      • memory/2248-17-0x0000000074DA0000-0x0000000075351000-memory.dmp

        Filesize

        5.7MB

      • memory/2248-26-0x00000000011F0000-0x0000000001200000-memory.dmp

        Filesize

        64KB

      • memory/2248-23-0x0000000074DA0000-0x0000000075351000-memory.dmp

        Filesize

        5.7MB

      • memory/3424-0-0x0000000000400000-0x00000000004FB000-memory.dmp

        Filesize

        1004KB

      • memory/3424-22-0x0000000000400000-0x00000000004FB000-memory.dmp

        Filesize

        1004KB

      • memory/3688-7-0x0000000001110000-0x0000000001120000-memory.dmp

        Filesize

        64KB

      • memory/3688-18-0x0000000074DA0000-0x0000000075351000-memory.dmp

        Filesize

        5.7MB

      • memory/3688-5-0x0000000074DA0000-0x0000000075351000-memory.dmp

        Filesize

        5.7MB

      • memory/3688-6-0x0000000074DA0000-0x0000000075351000-memory.dmp

        Filesize

        5.7MB