Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 04:06

General

  • Target

    8b5a798a5aefc7817f4ad1412e69a6ce.exe

  • Size

    291KB

  • MD5

    8b5a798a5aefc7817f4ad1412e69a6ce

  • SHA1

    cef0d699332025e8da7fe747eb69346be932cb9d

  • SHA256

    36bcbc6f042482039ffd4e6f5c4c83ce5b86394da2506670b86d3d7525f79549

  • SHA512

    0af6f31e22c82890d5e81424fa2ff7a47d2c98e43d5d3ba4541c045920a536158cdc080f32194ccfb84d1e802be3e5192e5d0bdeb89740fcadca33bf08fefafd

  • SSDEEP

    768:crKFygpFRA/vMHTi9bDoMVpb0mjv8gx5poyKcMYocg3arRw:uKFygOnYi9bRVBjv8YoyIYxgy

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

0909909

C2

174.67.28.4:6786

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b5a798a5aefc7817f4ad1412e69a6ce.exe
    "C:\Users\Admin\AppData\Local\Temp\8b5a798a5aefc7817f4ad1412e69a6ce.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Users\Admin\AppData\Local\Temp\Payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:2776
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
      2⤵
      • Views/modifies file attributes
      PID:2760

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

          Filesize

          1KB

          MD5

          2a5cb068b79e07db9f89c97868325267

          SHA1

          a19e71347f4763e408cad2bb15430956045cf002

          SHA256

          7c17c22002894349eb618786aae5f72b3bc168d5e9e48b4de6efe98ab05bc6db

          SHA512

          8a235c4c397f4d4864834392a808260ad643d213b0cced98675ef56e3ed169bcb7cefc2a46ff743fa5443ddf006f2864627baf273dfbe0b5abf996352e7d4961

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

          Filesize

          1022B

          MD5

          92f19613c496364ce789460ab170df13

          SHA1

          928eee23d3385c60f6b767b6e489f591c0231599

          SHA256

          dc6f5e77fdab54bbc9ecf447282977fa0ac7bfc9c49aeb8f1125b3ce94353515

          SHA512

          d3089580132c248f2ebcb1474da5a9777fb1919f63c0f1d59d502ff1287fb3f8430abf831bb0074c6a05a6ff3b918c9c75ab6a93b3ef9e8c440c84ac413c0ebf

        • \Users\Admin\AppData\Local\Temp\Payload.exe

          Filesize

          291KB

          MD5

          8b5a798a5aefc7817f4ad1412e69a6ce

          SHA1

          cef0d699332025e8da7fe747eb69346be932cb9d

          SHA256

          36bcbc6f042482039ffd4e6f5c4c83ce5b86394da2506670b86d3d7525f79549

          SHA512

          0af6f31e22c82890d5e81424fa2ff7a47d2c98e43d5d3ba4541c045920a536158cdc080f32194ccfb84d1e802be3e5192e5d0bdeb89740fcadca33bf08fefafd

        • memory/2280-0-0x0000000074360000-0x000000007490B000-memory.dmp

          Filesize

          5.7MB

        • memory/2280-1-0x0000000074360000-0x000000007490B000-memory.dmp

          Filesize

          5.7MB

        • memory/2280-2-0x0000000002010000-0x0000000002050000-memory.dmp

          Filesize

          256KB

        • memory/2280-12-0x0000000074360000-0x000000007490B000-memory.dmp

          Filesize

          5.7MB

        • memory/2776-13-0x0000000000340000-0x0000000000380000-memory.dmp

          Filesize

          256KB

        • memory/2776-14-0x0000000074360000-0x000000007490B000-memory.dmp

          Filesize

          5.7MB

        • memory/2776-19-0x0000000074360000-0x000000007490B000-memory.dmp

          Filesize

          5.7MB

        • memory/2776-21-0x0000000000340000-0x0000000000380000-memory.dmp

          Filesize

          256KB

        • memory/2776-22-0x0000000074360000-0x000000007490B000-memory.dmp

          Filesize

          5.7MB