Malware Analysis Report

2025-01-22 14:01

Sample ID 240228-hqdlmsdg5x
Target ab4732bf791e42716a74276901601faa
SHA256 7c6df9095c974d5e5991cca2dc49cc526eb44d4154edf20b0a5eea1611e7381c
Tags
njrat hacked evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7c6df9095c974d5e5991cca2dc49cc526eb44d4154edf20b0a5eea1611e7381c

Threat Level: Known bad

The file ab4732bf791e42716a74276901601faa was found to be: Known bad.

Malicious Activity Summary

njrat hacked evasion persistence trojan

njRAT/Bladabindi

Modifies Windows Firewall

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-28 06:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-28 06:56

Reported

2024-02-28 06:58

Platform

win7-20240221-en

Max time kernel

147s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OperaSetups = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker\\RuntimeBroker.exe" C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe

"C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe"

C:\Users\Admin\AppData\Local\Temp\S^X.exe

"C:\Users\Admin\AppData\Local\Temp\S^X.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\S^X.exe" "S^X.exe" ENABLE

Network

Country Destination Domain Proto
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp

Files

memory/1812-0-0x00000000740C0000-0x00000000747AE000-memory.dmp

memory/1812-1-0x0000000000310000-0x00000000007EC000-memory.dmp

memory/1812-3-0x0000000000A60000-0x0000000000AB2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\S^X.exe

MD5 ab4732bf791e42716a74276901601faa
SHA1 0d29d6e42b56533db20a5c8f6c6bc85d0a8c2836
SHA256 7c6df9095c974d5e5991cca2dc49cc526eb44d4154edf20b0a5eea1611e7381c
SHA512 21bf321e0e0bb3733c58055f45a07b099fd3bd9f58ac691798ed57aad6ed74348914f329f5fad5e7e063956703a2279829657f8493102e8e17d1069e9adeb5a9

memory/2404-11-0x00000000001B0000-0x000000000068C000-memory.dmp

memory/2404-12-0x00000000740C0000-0x00000000747AE000-memory.dmp

memory/1812-13-0x00000000740C0000-0x00000000747AE000-memory.dmp

memory/2404-14-0x00000000050D0000-0x0000000005110000-memory.dmp

memory/2404-15-0x00000000740C0000-0x00000000747AE000-memory.dmp

memory/2404-16-0x00000000050D0000-0x0000000005110000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-28 06:56

Reported

2024-02-28 06:58

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OperaSetups = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker\\RuntimeBroker.exe" C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S^X.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe

"C:\Users\Admin\AppData\Local\Temp\ab4732bf791e42716a74276901601faa.exe"

C:\Users\Admin\AppData\Local\Temp\S^X.exe

"C:\Users\Admin\AppData\Local\Temp\S^X.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\S^X.exe" "S^X.exe" ENABLE

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2660 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
GB 216.58.201.106:443 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp
N/A 127.0.0.1:5552 tcp

Files

memory/664-0-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/664-1-0x0000000000F00000-0x00000000013DC000-memory.dmp

memory/664-2-0x0000000005DF0000-0x0000000005E8C000-memory.dmp

memory/664-3-0x0000000006440000-0x00000000069E4000-memory.dmp

memory/664-5-0x0000000005E90000-0x0000000005EE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\S^X.exe

MD5 073bcfbc8e7dcd7c94a0b6345b17e408
SHA1 c8cfb17705e7394743f3e56f5a607e412adf6266
SHA256 6c955c30a4436806ad00b2ff511c5c365b6b8907f5e6d2e27c28b573f3c8ade1
SHA512 9b2e1255536d87f8517c4c5631d83beb08b06744367bf44c53218d51c7dd8967ec7fc489873e3ea4f385b982a0bd0bacd3c6778731c152fbe11543f98e214f75

C:\Users\Admin\AppData\Local\Temp\S^X.exe

MD5 78671e421dbd8cf7fd786dd34bf59625
SHA1 cfabec837e8912f2ddf26c4072e652a246248751
SHA256 863149b777f5667d85b04dbd27ea419023052dbba3f13c050451e2ee146da2ae
SHA512 2835462d381ab3722597b76f00aef32a94c99ab1d871b78ea22b3cac0938961f6d8302762eba710fde7dcf3e1e93b13e6894bf2f977e1c7868d628b05e8c2e98

C:\Users\Admin\AppData\Local\Temp\S^X.exe

MD5 c6d8b6b7b203227e0ba2746868ebf5b6
SHA1 c6a463e0c10dbe47e5d12a92ccb3eb1014619913
SHA256 f628a0a0af07c9fc3347ea35166b36ff3f47aa661e6b6a83848197e26eddced7
SHA512 aef96eaddaee70b91afae41feda417eea5c52f4aed3522cffb5a5abc7e81276dab68dd7f1f6c0ea8d7e6ce8de5350c749596c9deaf30ae0074b0008c0c3ccea4

memory/4028-18-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/664-19-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/4028-20-0x0000000005070000-0x0000000005080000-memory.dmp

memory/4028-21-0x0000000005120000-0x00000000051B2000-memory.dmp

memory/4028-22-0x00000000050B0000-0x00000000050BA000-memory.dmp

memory/4028-23-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/4028-24-0x0000000005070000-0x0000000005080000-memory.dmp