Overview

overview

10

Static

static

3

a3e614d1a2...12.exe

windows7-x64

10

a3e614d1a2...12.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 13:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a3e614d1a2956cde029cb3ce1b499d12.exe
  • Size 319KB
  • Sample240225-qps9psce72
  • SHA256 c79ab21cf7fc23b9a096c4d9aa5b7cd02d968b8dfc58b137c2df44b1e55307b6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
njratkavachevasionpersistencetrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • kavach

C2

  • 149.248.52.61:89

Mutex

  • 7115957173d2bd058f96a963a8334ea1

Attributes
  • reg_key

    7115957173d2bd058f96a963a8334ea1

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3e614d1a2956cde029cb3ce1b499d12.exe
    "C:\Users\Admin\AppData\Local\Temp\a3e614d1a2956cde029cb3ce1b499d12.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\go.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1072
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C start iexplore.exe https://kavach.mail.gov.in/
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" https://kavach.mail.gov.in/
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:804
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:804 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:364
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\winhost.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\winhost.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3140
      • C:\Users\Admin\AppData\Roaming\server.exe
        "C:\Users\Admin\AppData\Roaming\server.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          PID:1548

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        suggestions[1].en-US
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9OA7RET8\suggestions[1].en-US
        • Size 17KB
        • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        go.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\go.vbs
        • Size 391B
        • SHA256 eedbd29387319cc474fa3e09d5d5e7af5ca6e6034872cc6617414b45899379a6
        • MD5 SHA1 SHA512
        Submit Download

        winhost.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\winhost.exe
        • Size 23KB
        • SHA256 7bf2d1167b4cd57a72aa1c34b2c3f978ed42569ff0494411af164b1ead715466
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3140-14-0x00000000731B0000-0x0000000073761000-memory.dmp
        Download

        memory/3140-15-0x0000000000F60000-0x0000000000F70000-memory.dmp
        Download

        memory/3140-16-0x00000000731B0000-0x0000000073761000-memory.dmp
        Download

        memory/3140-26-0x00000000731B0000-0x0000000073761000-memory.dmp
        Download

        memory/4612-27-0x00000000731B0000-0x0000000073761000-memory.dmp
        Download

        memory/4612-28-0x00000000012F0000-0x0000000001300000-memory.dmp
        Download

        memory/4612-29-0x00000000731B0000-0x0000000073761000-memory.dmp
        Download

        memory/4612-40-0x00000000731B0000-0x0000000073761000-memory.dmp
        Download

        memory/4612-41-0x00000000012F0000-0x0000000001300000-memory.dmp
        Download