Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2024, 04:38

General

  • Target

    69817c6819e95aaf0298bec8e390c45e.exe

  • Size

    184KB

  • MD5

    69817c6819e95aaf0298bec8e390c45e

  • SHA1

    b159473871a1a2ea82af6938fbd5bb96e4e59929

  • SHA256

    504120144c29d628d287057fb3ef914ba89b3672c7638af5a104771843a4913f

  • SHA512

    c449e5ebe9748649cfc3cf54ab68af670d88a7ca49062a7832c80959dfee995805c26b64e54b2b5e0002a81c1b5b390e42cafc3b3a59a17ed9acfedcd31b6bc1

  • SSDEEP

    768:xQPeqA6136p6Zr/GH9lOQup0RPxGOHI5QgDgW+GTX3QOF711zNxJl4R:xQGqhKurglfup0jdgDgJ4HQOD1pxJa

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

error404.linkpc.net:1177

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69817c6819e95aaf0298bec8e390c45e.exe
    "C:\Users\Admin\AppData\Local\Temp\69817c6819e95aaf0298bec8e390c45e.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\ProgramData\Server.exe
      "C:\ProgramData\Server.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
        3⤵
        • Drops startup file
        • Views/modifies file attributes
        PID:2364
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
        3⤵
        • Views/modifies file attributes
        PID:1340
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\ProgramData\Server.exe"
      2⤵
      • Views/modifies file attributes
      PID:1420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Server.exe

    Filesize

    184KB

    MD5

    69817c6819e95aaf0298bec8e390c45e

    SHA1

    b159473871a1a2ea82af6938fbd5bb96e4e59929

    SHA256

    504120144c29d628d287057fb3ef914ba89b3672c7638af5a104771843a4913f

    SHA512

    c449e5ebe9748649cfc3cf54ab68af670d88a7ca49062a7832c80959dfee995805c26b64e54b2b5e0002a81c1b5b390e42cafc3b3a59a17ed9acfedcd31b6bc1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

    Filesize

    1KB

    MD5

    371e9f5c5222743275e228f1b3d27fb1

    SHA1

    31b0a7ada0ee8c593d1f7d4b8fa3f830566a5fd6

    SHA256

    5684b6a81a92bef5cd5eb049a0e905dc99e7db95d907443f182614b9b48602f1

    SHA512

    14f203f243e9c69a3b3e1beaf8599d5cd0f18627e446a3beac78cb611bb4259ffb4c47ece4da3d3ff4ee1dd01aa379b081a3548844070d3b7312f56d22ffc78f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

    Filesize

    1KB

    MD5

    a0e21c3cda955b529c05da3ebc737559

    SHA1

    7cede9bd6a34b2ddb326c3733057cf76b11e3d45

    SHA256

    b34c6f792079e84046ce8c2049f6f233e6c235f025770a028dfc8d57bc54af8c

    SHA512

    e37365ed423d523ca996460ab7adab0a19923906413d22cccde2f1ce144ea25deef5e1a2a6d3cc8580952ebd58438f36f5eb2cb82348e1e3d126fa248d5fc18a

  • memory/3772-29-0x0000000005640000-0x00000000056A6000-memory.dmp

    Filesize

    408KB

  • memory/3772-30-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/3772-33-0x0000000006600000-0x000000000660A000-memory.dmp

    Filesize

    40KB

  • memory/3772-32-0x0000000006620000-0x00000000066B2000-memory.dmp

    Filesize

    584KB

  • memory/3772-19-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/3772-20-0x0000000004BF0000-0x0000000004C00000-memory.dmp

    Filesize

    64KB

  • memory/3772-31-0x0000000004BF0000-0x0000000004C00000-memory.dmp

    Filesize

    64KB

  • memory/4800-1-0x00000000000E0000-0x0000000000114000-memory.dmp

    Filesize

    208KB

  • memory/4800-26-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4800-0-0x0000000074B00000-0x00000000752B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4800-4-0x0000000004C20000-0x0000000004CBC000-memory.dmp

    Filesize

    624KB

  • memory/4800-2-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/4800-3-0x0000000002570000-0x000000000257E000-memory.dmp

    Filesize

    56KB

  • memory/4800-7-0x00000000058F0000-0x0000000005E94000-memory.dmp

    Filesize

    5.6MB