Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 09:32

General

  • Target

    8bfdedc30182ece284b09591788cc931.exe

  • Size

    402KB

  • MD5

    8bfdedc30182ece284b09591788cc931

  • SHA1

    4ff3a3ad179c7bb9aa91493beb6ed30882fe8e46

  • SHA256

    00b99ceddb783a0fe3cac7aa2faa936ab54c5d6ff42280aaa307b04175c97103

  • SHA512

    92c584c203e66e95352109666f538ab4252543331dd9bda2463e4caec4e08b713796ca598babdd4260f43451f99fd6d1ee008bbbd0e6cf9d1edce1d6d2b4af15

  • SSDEEP

    6144:JmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgW:eSmLAuEY71fviagATFmebVQDcYc6

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

pdf

C2

hhhmach.ddns.net:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bfdedc30182ece284b09591788cc931.exe
    "C:\Users\Admin\AppData\Local\Temp\8bfdedc30182ece284b09591788cc931.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 260
      2⤵
      • Program crash
      PID:4212
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c test.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1460
      • C:\Users\Admin\AppData\Local\Temp\test.exe
        test.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Users\Admin\AppData\Local\Temp\Trojan.exe
          "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 164
      2⤵
      • Program crash
      PID:3720
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4288 -ip 4288
    1⤵
      PID:4348
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
      1⤵
      • Modifies Windows Firewall
      PID:2936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4288 -ip 4288
      1⤵
        PID:3968

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\Trojan.exe

              Filesize

              35KB

              MD5

              72b73eaf6a91ecfaf35b96652a94e3b3

              SHA1

              9459172d9c6f1f67da9c278d4eb9f0be437ef5ec

              SHA256

              bf1be6dc394164cdb8f185955e634febb6a1e6229c7d5c3183b5c4cc1545d5f2

              SHA512

              dd6913a7014e34162e3b5dbf929fcc99e1aa1491051fc9c35d1440fe5c100061c911adb8f2c5c05acf62a35125d195f2c6a143c6bd6c7914e0b4d4c4aecaee7d

            • C:\Users\Admin\AppData\Local\Temp\test.exe

              Filesize

              78KB

              MD5

              42c5854aa0709d8bf6c28ea82c67b9a5

              SHA1

              124ea473f0572009de85a4a46f361109f4fae7d6

              SHA256

              71e1add662041fee9ff0ddf0139154cf006538559af45f34047aac91efb1b8eb

              SHA512

              c0f4412f2237138b5b66ecc285d7f44bacd67ae23feb0a55561cd4f7850ee6b0fd1b1dac3d2725ed4932aaf155b0fbda284a69b07594789bdb4cbcf0f499d95a

            • C:\Users\Admin\AppData\Local\Temp\test.exe

              Filesize

              77KB

              MD5

              a03fed79dc35f460551dd70da2f46715

              SHA1

              375f9048b51b92b7ecf4a8606070368be1ad71cb

              SHA256

              d180b725c61b5e56850904832aff1ce0f6d99cd26d02f119f5f8cea60146ab9e

              SHA512

              8e67f1e688238193034bece7d2bf87601ced58e2ef2319fbd4e2b3c0998b8972bfc9ae5d24b35846b7a5a35a6f57c10de4879fe77dcd87f653fc098e6e644266

            • memory/1100-21-0x0000000000C60000-0x0000000000C70000-memory.dmp

              Filesize

              64KB

            • memory/1100-20-0x0000000074DD0000-0x0000000075381000-memory.dmp

              Filesize

              5.7MB

            • memory/1100-19-0x0000000074DD0000-0x0000000075381000-memory.dmp

              Filesize

              5.7MB

            • memory/1100-23-0x0000000074DD0000-0x0000000075381000-memory.dmp

              Filesize

              5.7MB

            • memory/1100-24-0x0000000000C60000-0x0000000000C70000-memory.dmp

              Filesize

              64KB

            • memory/3036-6-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

              Filesize

              64KB

            • memory/3036-5-0x0000000074DD0000-0x0000000075381000-memory.dmp

              Filesize

              5.7MB

            • memory/3036-7-0x0000000074DD0000-0x0000000075381000-memory.dmp

              Filesize

              5.7MB

            • memory/3036-17-0x0000000074DD0000-0x0000000075381000-memory.dmp

              Filesize

              5.7MB

            • memory/4288-0-0x0000000000400000-0x00000000004FA000-memory.dmp

              Filesize

              1000KB

            • memory/4288-22-0x0000000000400000-0x00000000004FA000-memory.dmp

              Filesize

              1000KB