Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2024, 02:01

General

  • Target

    78fd42f0ec9a7ecf52ef805bf3d1db88.exe

  • Size

    25KB

  • MD5

    78fd42f0ec9a7ecf52ef805bf3d1db88

  • SHA1

    f917d69c6a8f51f47d2a8dd4f92a54c974ab01f7

  • SHA256

    8cf4c92a9e57a674510432fbda9543c350d3191aca49844f39e01fb4145a0a9f

  • SHA512

    4471c05eb0378bab820a4fa4595ec14a5a66b5099401b6c17414ace59da992a4f979337099622675be9dbb012212f21dffe89ae16aa10efbf41c8df7b732e97b

  • SSDEEP

    768:QL+C2aKZGdp0WAhO4aaQeXixmqenlMMVX:Qf11AhPnXiknlMUX

Malware Config

Extracted

Family

njrat

Version

SH Stub

Mutex

CARDDfTfqdeb

Attributes
  • reg_key

    CARDDfTfqdeb

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78fd42f0ec9a7ecf52ef805bf3d1db88.exe
    "C:\Users\Admin\AppData\Local\Temp\78fd42f0ec9a7ecf52ef805bf3d1db88.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Startup" /t REG_SZ /d C:\Users\Public\Documents\svchost /f
        3⤵
        • Adds Run key to start application
        PID:2672

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3480-0-0x00007FF9ADEA0000-0x00007FF9AE841000-memory.dmp

          Filesize

          9.6MB

        • memory/3480-1-0x0000000001440000-0x0000000001450000-memory.dmp

          Filesize

          64KB

        • memory/3480-2-0x0000000001390000-0x000000000139A000-memory.dmp

          Filesize

          40KB

        • memory/3480-4-0x000000001C5F0000-0x000000001CABE000-memory.dmp

          Filesize

          4.8MB

        • memory/3480-3-0x00007FF9ADEA0000-0x00007FF9AE841000-memory.dmp

          Filesize

          9.6MB

        • memory/3480-5-0x000000001BFA0000-0x000000001BFE6000-memory.dmp

          Filesize

          280KB

        • memory/3480-7-0x00007FF9ADEA0000-0x00007FF9AE841000-memory.dmp

          Filesize

          9.6MB

        • memory/3480-8-0x0000000001440000-0x0000000001450000-memory.dmp

          Filesize

          64KB

        • memory/3480-9-0x000000001D6C0000-0x000000001D766000-memory.dmp

          Filesize

          664KB

        • memory/3480-10-0x000000001D8C0000-0x000000001D95C000-memory.dmp

          Filesize

          624KB

        • memory/3480-11-0x00000000013E0000-0x00000000013E8000-memory.dmp

          Filesize

          32KB