Analysis

  • max time kernel
    148s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 02:01

General

  • Target

    78fd42f0ec9a7ecf52ef805bf3d1db88.exe

  • Size

    25KB

  • MD5

    78fd42f0ec9a7ecf52ef805bf3d1db88

  • SHA1

    f917d69c6a8f51f47d2a8dd4f92a54c974ab01f7

  • SHA256

    8cf4c92a9e57a674510432fbda9543c350d3191aca49844f39e01fb4145a0a9f

  • SHA512

    4471c05eb0378bab820a4fa4595ec14a5a66b5099401b6c17414ace59da992a4f979337099622675be9dbb012212f21dffe89ae16aa10efbf41c8df7b732e97b

  • SSDEEP

    768:QL+C2aKZGdp0WAhO4aaQeXixmqenlMMVX:Qf11AhPnXiknlMUX

Score
10/10

Malware Config

Extracted

Family

njrat

Version

SH Stub

Mutex

CARDDfTfqdeb

Attributes
  • reg_key

    CARDDfTfqdeb

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78fd42f0ec9a7ecf52ef805bf3d1db88.exe
    "C:\Users\Admin\AppData\Local\Temp\78fd42f0ec9a7ecf52ef805bf3d1db88.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1068
    • C:\Windows\system32\cmd.exe
      "cmd.exe"
      2⤵
        PID:2148

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1068-0-0x0000000000860000-0x000000000086A000-memory.dmp

            Filesize

            40KB

          • memory/1068-1-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

            Filesize

            9.6MB

          • memory/1068-2-0x00000000023B0000-0x0000000002430000-memory.dmp

            Filesize

            512KB

          • memory/1068-3-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

            Filesize

            9.6MB

          • memory/1068-6-0x00000000023B0000-0x0000000002430000-memory.dmp

            Filesize

            512KB

          • memory/1068-5-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

            Filesize

            9.6MB