Analysis
- max time kernel
59s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
24/02/2024, 03:23
General
- Target New Client.exe
- Size 188KB
- Sample240224-dxslxsff85
- SHA256 13fde5c8aeb2fe2335dcb803a1a31a404e2f65e990d2a728a0df681ef832b616
Malware Config
Extracted
-
njrat
-
Platinum
-
AntiVirus
-
127.0.0.1:38277
-
Client.exe
-
reg_key
Client.exe
-
splitter
|Ghost|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 3 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 3 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f im explorer.exe2⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Temp\2f0a0f36e26b4a1fac1b7b824fa348eb.exe"C:\Users\Admin\AppData\Local\Temp\2f0a0f36e26b4a1fac1b7b824fa348eb.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
2f0a0f36e26b4a1fac1b7b824fa348eb.exe
memory/1620-28-0x00000000005A0000-0x00000000005B2000-memory.dmp
memory/1620-27-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2384-13-0x000000001D090000-0x000000001D0F2000-memory.dmp
memory/2384-15-0x0000000000C60000-0x0000000000C70000-memory.dmp
memory/2384-5-0x000000001C290000-0x000000001C336000-memory.dmp
memory/2384-11-0x000000001CF80000-0x000000001D01C000-memory.dmp
memory/2384-12-0x0000000000C00000-0x0000000000C08000-memory.dmp
memory/2384-0-0x000000001B660000-0x000000001BB2E000-memory.dmp
memory/2384-14-0x000000001D280000-0x000000001D299000-memory.dmp
memory/2384-4-0x000000001C030000-0x000000001C06A000-memory.dmp
memory/2384-17-0x0000000000C60000-0x0000000000C70000-memory.dmp
memory/2384-16-0x00007FFE6AF20000-0x00007FFE6B8C1000-memory.dmp
memory/2384-18-0x0000000000C60000-0x0000000000C70000-memory.dmp
memory/2384-19-0x0000000000A90000-0x0000000000A9A000-memory.dmp
memory/2384-3-0x00007FFE6AF20000-0x00007FFE6B8C1000-memory.dmp
memory/2384-2-0x0000000000C60000-0x0000000000C70000-memory.dmp
memory/2384-1-0x00007FFE6AF20000-0x00007FFE6B8C1000-memory.dmp