Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
05/02/2024, 01:15
General
- Target f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe
- Size 189KB
- Sample240205-bmdznshbfk
- SHA256 f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79
Malware Config
Extracted
-
njrat
-
0.7NC
-
NYAN CAT
-
vinijr27.duckdns.org:3030
-
a4729d8cd4374
-
reg_key
a4729d8cd4374
-
splitter
@!#&^%$
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 29 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe"C:\Users\Admin\AppData\Local\Temp\f1400947f65c4f4b6770ca97877b7e6bbfc97deef656e20a064e542e2cd31d79.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/736-2-0x0000000000400000-0x000000000040C000-memory.dmp
memory/736-5-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/736-6-0x0000000005590000-0x000000000562C000-memory.dmp
memory/736-7-0x0000000005BE0000-0x0000000006184000-memory.dmp
memory/736-8-0x0000000005670000-0x0000000005680000-memory.dmp
memory/736-9-0x00000000057E0000-0x0000000005872000-memory.dmp
memory/736-10-0x00000000057D0000-0x00000000057DA000-memory.dmp
memory/736-11-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/736-12-0x0000000005670000-0x0000000005680000-memory.dmp
memory/3280-1-0x0000000000DA0000-0x0000000000DA3000-memory.dmp
memory/3280-3-0x0000000001790000-0x0000000001873000-memory.dmp
memory/3280-4-0x0000000001880000-0x0000000001A20000-memory.dmp