Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
27/01/2024, 02:01
General
- Target 78fd42f0ec9a7ecf52ef805bf3d1db88.exe
- Size 25KB
- Sample240127-cfmtnsahe7
- SHA256 8cf4c92a9e57a674510432fbda9543c350d3191aca49844f39e01fb4145a0a9f
Malware Config
Extracted
-
njrat
-
SH Stub
-
CARDDfTfqdeb
-
reg_key
CARDDfTfqdeb
-
splitter
|'|'|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 29 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78fd42f0ec9a7ecf52ef805bf3d1db88.exe"C:\Users\Admin\AppData\Local\Temp\78fd42f0ec9a7ecf52ef805bf3d1db88.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Startup" /t REG_SZ /d C:\Users\Public\Documents\svchost /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3480-0-0x00007FF9ADEA0000-0x00007FF9AE841000-memory.dmp
memory/3480-1-0x0000000001440000-0x0000000001450000-memory.dmp
memory/3480-2-0x0000000001390000-0x000000000139A000-memory.dmp
memory/3480-4-0x000000001C5F0000-0x000000001CABE000-memory.dmp
memory/3480-3-0x00007FF9ADEA0000-0x00007FF9AE841000-memory.dmp
memory/3480-5-0x000000001BFA0000-0x000000001BFE6000-memory.dmp
memory/3480-7-0x00007FF9ADEA0000-0x00007FF9AE841000-memory.dmp
memory/3480-8-0x0000000001440000-0x0000000001450000-memory.dmp
memory/3480-9-0x000000001D6C0000-0x000000001D766000-memory.dmp
memory/3480-10-0x000000001D8C0000-0x000000001D95C000-memory.dmp
memory/3480-11-0x00000000013E0000-0x00000000013E8000-memory.dmp