Malware Analysis Report

2025-03-15 06:25

Sample ID 240127-lt6ndahgc3
Target 79ec0d5a155f294d8657517e44594e30
SHA256 02418045caf449cd45f3b7f9c377ed8ef989f0c7b44fcd28b22eec97a0965084
Tags
njrat hacked evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

02418045caf449cd45f3b7f9c377ed8ef989f0c7b44fcd28b22eec97a0965084

Threat Level: Known bad

The file 79ec0d5a155f294d8657517e44594e30 was found to be: Known bad.

Malicious Activity Summary

njrat hacked evasion persistence trojan

njRAT/Bladabindi

Modifies Windows Firewall

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-27 09:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-27 09:50

Reported

2024-01-27 09:53

Platform

win7-20231129-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\79ec0d5a155f294d8657517e44594e30.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Wllbswueyrkww.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\79ec0d5a155f294d8657517e44594e30.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\603bc880d672bed07b545522ddd17034 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Axwc.exe\" .." C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\603bc880d672bed07b545522ddd17034 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Axwc.exe\" .." C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\79ec0d5a155f294d8657517e44594e30.exe

"C:\Users\Admin\AppData\Local\Temp\79ec0d5a155f294d8657517e44594e30.exe"

C:\Users\Admin\AppData\Local\Temp\Axwc.exe

"C:\Users\Admin\AppData\Local\Temp\Axwc.exe"

C:\Users\Admin\AppData\Local\Temp\Wllbswueyrkww.exe

"C:\Users\Admin\AppData\Local\Temp\Wllbswueyrkww.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Axwc.exe" "Axwc.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 lati10.ddns.net udp

Files

memory/2996-1-0x0000000073F30000-0x000000007461E000-memory.dmp

memory/2996-0-0x0000000000400000-0x0000000000992000-memory.dmp

memory/2996-2-0x0000000004F20000-0x0000000004F60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Axwc.exe

MD5 60f8cb6b158dc8cef61aae72362f1b65
SHA1 e3870d948d717d0eb585a6e04218e47769f5fb17
SHA256 bbdd9b5a4c402d04dffb2ac0257ccf32a765ad4019c9f9feca45d6e830c9c3ee
SHA512 77694a3ae340b50c1ed92bf0eb0abe4ac25e4d053a221e3032910db7dc59af258dac09bc14beb7e3f41a43840facba0bf2782e9f9928783ce7eec41eec7da3d0

memory/2552-10-0x000000006F1F0000-0x000000006F79B000-memory.dmp

memory/2552-13-0x000000006F1F0000-0x000000006F79B000-memory.dmp

memory/2552-14-0x00000000001A0000-0x00000000001E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Wllbswueyrkww.exe

MD5 009216c1d5711faa71ff605f765eb431
SHA1 3fc6e9ed3845255b3b98c152a597eb8c430ad087
SHA256 7f05641239860092482ceab7aa3b77c34bf9b3447285771ca2bcdda414ce9984
SHA512 616dceba6a4d61d322d27f953bddcee07771ca59fc3ef72db8c746d82ab5793720bba406be944227946624313c7eb20a1ced8df70450c302bd03d37652808477

memory/2996-17-0x0000000073F30000-0x000000007461E000-memory.dmp

memory/2996-18-0x0000000004F20000-0x0000000004F60000-memory.dmp

memory/2552-19-0x000000006F1F0000-0x000000006F79B000-memory.dmp

memory/2552-20-0x00000000001A0000-0x00000000001E0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-27 09:50

Reported

2024-01-27 09:53

Platform

win10v2004-20231215-en

Max time kernel

158s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\79ec0d5a155f294d8657517e44594e30.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\79ec0d5a155f294d8657517e44594e30.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Wllbswueyrkww.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\603bc880d672bed07b545522ddd17034 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Axwc.exe\" .." C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\603bc880d672bed07b545522ddd17034 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Axwc.exe\" .." C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Axwc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\79ec0d5a155f294d8657517e44594e30.exe

"C:\Users\Admin\AppData\Local\Temp\79ec0d5a155f294d8657517e44594e30.exe"

C:\Users\Admin\AppData\Local\Temp\Axwc.exe

"C:\Users\Admin\AppData\Local\Temp\Axwc.exe"

C:\Users\Admin\AppData\Local\Temp\Wllbswueyrkww.exe

"C:\Users\Admin\AppData\Local\Temp\Wllbswueyrkww.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Axwc.exe" "Axwc.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp
US 8.8.8.8:53 lati10.ddns.net udp

Files

memory/4156-0-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/4156-1-0x0000000000400000-0x0000000000992000-memory.dmp

memory/4156-2-0x0000000005020000-0x00000000055C4000-memory.dmp

memory/4156-3-0x0000000004EE0000-0x0000000004F72000-memory.dmp

memory/4156-4-0x0000000005670000-0x0000000005680000-memory.dmp

memory/4156-5-0x00000000055F0000-0x00000000055FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Axwc.exe

MD5 60f8cb6b158dc8cef61aae72362f1b65
SHA1 e3870d948d717d0eb585a6e04218e47769f5fb17
SHA256 bbdd9b5a4c402d04dffb2ac0257ccf32a765ad4019c9f9feca45d6e830c9c3ee
SHA512 77694a3ae340b50c1ed92bf0eb0abe4ac25e4d053a221e3032910db7dc59af258dac09bc14beb7e3f41a43840facba0bf2782e9f9928783ce7eec41eec7da3d0

memory/4796-14-0x000000006F7E0000-0x000000006FD91000-memory.dmp

memory/4796-18-0x000000006F7E0000-0x000000006FD91000-memory.dmp

memory/4796-26-0x0000000000E60000-0x0000000000E70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Wllbswueyrkww.exe

MD5 7ef5b4ece0f8d60e14256f4eb5e43b44
SHA1 c30bdb87f3e84c2d0060edf089d9578686a898ae
SHA256 16ab962cc9ee80ead31680b6d23be231469893636d69076d0dbcaaa7737bc985
SHA512 e407349a9bf5c7a7d5b2fe181357b40b818c27229bc0228d4b0953eccc5887698dbd79c5ac7ddf84fb1d96ca00176a1b52c0600b53ed355c2d36e960742a7170

memory/4156-29-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/4156-30-0x0000000005670000-0x0000000005680000-memory.dmp

memory/4796-31-0x000000006F7E0000-0x000000006FD91000-memory.dmp

memory/4796-32-0x000000006F7E0000-0x000000006FD91000-memory.dmp

memory/4796-33-0x0000000000E60000-0x0000000000E70000-memory.dmp