Analysis

  • max time kernel
    59s
  • max time network
    92s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-02-2024 03:23

General

  • Target

    New Client.exe

  • Size

    188KB

  • MD5

    b848808a7c3f542eaf9718c0c8e0159f

  • SHA1

    c8fc1af2a0e6df1be9426b5f2e636b7f2b1aa302

  • SHA256

    13fde5c8aeb2fe2335dcb803a1a31a404e2f65e990d2a728a0df681ef832b616

  • SHA512

    0eb66a47448b588cdbd4b1b1d426c70b10fd073f2612a1f45e3abbec7b61f35735ff2a8cfeb1eb3f5390f89cc3abd88522a1c7ff20ddc8857242e8ce7335ac2d

  • SSDEEP

    3072:p2B+64kQ2EJam2dNREz9Vnc4OZMJwGu3U4QyZom8exsrPR5TE7D0XuDTTo6M//lz:p2B+64kQ2EJam2dNREz9FdOZMJwGuE42

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

AntiVirus

C2

127.0.0.1:38277

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Client.exe
    "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\SYSTEM32\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:388
    • C:\Windows\SYSTEM32\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1076
    • C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f im explorer.exe
      2⤵
      • Kills process with taskkill
      PID:4372
    • C:\Users\Admin\AppData\Local\Temp\2f0a0f36e26b4a1fac1b7b824fa348eb.exe
      "C:\Users\Admin\AppData\Local\Temp\2f0a0f36e26b4a1fac1b7b824fa348eb.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of AdjustPrivilegeToken
      PID:1620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2f0a0f36e26b4a1fac1b7b824fa348eb.exe

    Filesize

    225KB

    MD5

    af2379cc4d607a45ac44d62135fb7015

    SHA1

    39b6d40906c7f7f080e6befa93324dddadcbd9fa

    SHA256

    26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739

    SHA512

    69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99

  • memory/1620-28-0x00000000005A0000-0x00000000005B2000-memory.dmp

    Filesize

    72KB

  • memory/1620-27-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2384-13-0x000000001D090000-0x000000001D0F2000-memory.dmp

    Filesize

    392KB

  • memory/2384-15-0x0000000000C60000-0x0000000000C70000-memory.dmp

    Filesize

    64KB

  • memory/2384-5-0x000000001C290000-0x000000001C336000-memory.dmp

    Filesize

    664KB

  • memory/2384-11-0x000000001CF80000-0x000000001D01C000-memory.dmp

    Filesize

    624KB

  • memory/2384-12-0x0000000000C00000-0x0000000000C08000-memory.dmp

    Filesize

    32KB

  • memory/2384-0-0x000000001B660000-0x000000001BB2E000-memory.dmp

    Filesize

    4.8MB

  • memory/2384-14-0x000000001D280000-0x000000001D299000-memory.dmp

    Filesize

    100KB

  • memory/2384-4-0x000000001C030000-0x000000001C06A000-memory.dmp

    Filesize

    232KB

  • memory/2384-17-0x0000000000C60000-0x0000000000C70000-memory.dmp

    Filesize

    64KB

  • memory/2384-16-0x00007FFE6AF20000-0x00007FFE6B8C1000-memory.dmp

    Filesize

    9.6MB

  • memory/2384-18-0x0000000000C60000-0x0000000000C70000-memory.dmp

    Filesize

    64KB

  • memory/2384-19-0x0000000000A90000-0x0000000000A9A000-memory.dmp

    Filesize

    40KB

  • memory/2384-3-0x00007FFE6AF20000-0x00007FFE6B8C1000-memory.dmp

    Filesize

    9.6MB

  • memory/2384-2-0x0000000000C60000-0x0000000000C70000-memory.dmp

    Filesize

    64KB

  • memory/2384-1-0x00007FFE6AF20000-0x00007FFE6B8C1000-memory.dmp

    Filesize

    9.6MB