Malware Analysis Report

2024-08-06 17:52

Sample ID 240314-me42nshe6s
Target c861f276d60588950214242b3ab35a17
SHA256 579180777a9a584fd9f6b08057c25e23c96f4f50a9107e754eba93b8cf51d5c4
Tags
njrat test evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

579180777a9a584fd9f6b08057c25e23c96f4f50a9107e754eba93b8cf51d5c4

Threat Level: Known bad

The file c861f276d60588950214242b3ab35a17 was found to be: Known bad.

Malicious Activity Summary

njrat test evasion trojan

njRAT/Bladabindi

Modifies Windows Firewall

Executes dropped EXE

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Defense Evasion
TA0005
Impair Defenses
T1562
Disable or Modify System Firewall
T1562.004
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-03-14 10:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 10:23

Reported

2024-03-14 10:26

Platform

win7-20240221-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c861f276d60588950214242b3ab35a17.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c861f276d60588950214242b3ab35a17.exe

"C:\Users\Admin\AppData\Local\Temp\c861f276d60588950214242b3ab35a17.exe"

Network

N/A

Files

memory/1928-0-0x0000000001370000-0x000000000139A000-memory.dmp

memory/1928-1-0x0000000074790000-0x0000000074E7E000-memory.dmp

memory/1928-2-0x0000000004DD0000-0x0000000004E10000-memory.dmp

memory/1928-3-0x0000000004DD0000-0x0000000004E10000-memory.dmp

memory/1928-5-0x0000000004DD0000-0x0000000004E10000-memory.dmp

memory/1928-4-0x0000000074790000-0x0000000074E7E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-14 10:23

Reported

2024-03-14 10:26

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c861f276d60588950214242b3ab35a17.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\Winrar.com N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: 33 N/A C:\Users\Admin\Documents\Winrar.com N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\Winrar.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3364 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\c861f276d60588950214242b3ab35a17.exe C:\Users\Admin\Documents\Winrar.com
PID 3364 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\c861f276d60588950214242b3ab35a17.exe C:\Users\Admin\Documents\Winrar.com
PID 3364 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\c861f276d60588950214242b3ab35a17.exe C:\Users\Admin\Documents\Winrar.com
PID 624 wrote to memory of 964 N/A C:\Users\Admin\Documents\Winrar.com C:\Windows\SysWOW64\netsh.exe
PID 624 wrote to memory of 964 N/A C:\Users\Admin\Documents\Winrar.com C:\Windows\SysWOW64\netsh.exe
PID 624 wrote to memory of 964 N/A C:\Users\Admin\Documents\Winrar.com C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c861f276d60588950214242b3ab35a17.exe

"C:\Users\Admin\AppData\Local\Temp\c861f276d60588950214242b3ab35a17.exe"

C:\Users\Admin\Documents\Winrar.com

C:\Users\Admin\Documents\Winrar.com

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\Documents\Winrar.com" "Winrar.com" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 19.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 210.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 201.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 182.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 75.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
US 8.8.8.8:53 anis54.ddns.net udp
GB 96.17.178.182:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp

Files

memory/3364-1-0x0000000075070000-0x0000000075820000-memory.dmp

memory/3364-0-0x0000000000010000-0x000000000003A000-memory.dmp

memory/3364-2-0x0000000004FB0000-0x0000000005554000-memory.dmp

memory/3364-3-0x0000000004A00000-0x0000000004A92000-memory.dmp

memory/3364-4-0x0000000004B40000-0x0000000004BDC000-memory.dmp

memory/3364-5-0x0000000004D40000-0x0000000004D50000-memory.dmp

memory/3364-6-0x0000000004AC0000-0x0000000004ACA000-memory.dmp

memory/3364-7-0x0000000004D40000-0x0000000004D50000-memory.dmp

memory/3364-8-0x0000000004D40000-0x0000000004D50000-memory.dmp

memory/3364-10-0x000000000DD20000-0x000000000DD86000-memory.dmp

memory/3364-11-0x0000000004D40000-0x0000000004D50000-memory.dmp

C:\Users\Admin\Documents\Winrar.com

MD5 ee7497583ca929064be19c9c6c5e5fec
SHA1 3e3c2955794e47fdd63a4a10d4ff7e8388f7e3f0
SHA256 115beea90d6874cbbd06c78f4bec0cfdbbe955cad242de74c84c534d5a17f72d
SHA512 96bc4e3b686fa6cc80217f6218bd40ffd2e67bfc5e348f9db541809c0b7b6d536cdab10c5a4c371a044dc5f937dbf43a4f61973ced72a092beeb2e176f64321c

memory/624-15-0x00000000705A0000-0x0000000070B51000-memory.dmp

memory/624-16-0x00000000705A0000-0x0000000070B51000-memory.dmp

memory/624-17-0x0000000000E10000-0x0000000000E20000-memory.dmp

memory/3364-19-0x0000000075070000-0x0000000075820000-memory.dmp

memory/624-20-0x00000000705A0000-0x0000000070B51000-memory.dmp

memory/624-21-0x00000000705A0000-0x0000000070B51000-memory.dmp

memory/624-22-0x0000000000E10000-0x0000000000E20000-memory.dmp