Overview

overview

10

Static

static

3

54d941e481...cs.exe

windows7-x64

10

54d941e481...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 02:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    54d941e481d1b05912ff5bce5b519f30_NeikiAnalytics.exe
  • Size 7.8MB
  • Sample240510-dff7kaeh91
  • SHA256 aa9999be347b5f20707fd9d38713f95c99619f384d4078f2cd992d4e495e25f8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
njratlkevasionpersistencetrojan

Malware Config

Extracted

Family

  • njrat

Version

  • im523

Botnet

  • lk

C2

  • main-peers.at.ply.gg:14391

Mutex

  • 10dbba546f79cfd65d5be18f9b8967bc

Attributes
  • reg_key

    10dbba546f79cfd65d5be18f9b8967bc

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 5 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\54d941e481d1b05912ff5bce5b519f30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\54d941e481d1b05912ff5bce5b519f30_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\sdf.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Screamer.sfx.exe
        Screamer.sfx.exe -p123
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2948
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Screamer.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Screamer.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3076
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX2\start.bat" "
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:996
            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\1.exe
              1.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4864
              • C:\Users\Admin\AppData\Local\Temp\browser.exe
                "C:\Users\Admin\AppData\Local\Temp\browser.exe"
                7⤵
                • Drops startup file
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops autorun.inf file
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2492
                • C:\Windows\SysWOW64\netsh.exe
                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\browser.exe" "browser.exe" ENABLE
                  8⤵
                  • Modifies Windows Firewall
                  PID:2440
            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\2.exe
              2.exe
              6⤵
              • Executes dropped EXE
              PID:2016
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x3f8 0x454
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4400

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Screamer.sfx.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Screamer.sfx.exe
        • Size 7.6MB
        • SHA256 dabe1776b0fad4e9e3e380ce1f502a21f17443ca36879e69af44cc2c0b8fff8e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sdf.bat
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sdf.bat
        • Size 39B
        • SHA256 1baa3bb26db8ad7306ea6c9596613b38881a3d415235e3e343a50c29d65bcb49
        • MD5 SHA1 SHA512
        Submit Download

        Screamer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\Screamer.exe
        • Size 7.3MB
        • SHA256 8bcce76dd5dbfb695da349aebc7664678ef02e3dcec0216607bcdf726166cacc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\1.exe
        • Size 37KB
        • SHA256 032cdbc99e1215fb5b23ff4aa322e21dafd32fd36f1147c5bb3880693b02e550
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\2.exe
        • Size 7.4MB
        • SHA256 f91c14c328544a2d4cc216c7c2115283806fa3201d40bd3c7c5d79dccd025b09
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        start.bat
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX2\start.bat
        • Size 35B
        • SHA256 9031146fd624a3d48e86c1c09376e14b28a257c29acb32fac0724b5a961f4fc5
        • MD5 SHA1 SHA512
        Submit Download

        memory/2016-34-0x0000000000820000-0x0000000000F80000-memory.dmp
        Download

        memory/2016-35-0x0000000005D70000-0x0000000006314000-memory.dmp
        Download

        memory/2016-36-0x0000000005860000-0x00000000058F2000-memory.dmp
        Download

        memory/2016-37-0x0000000005840000-0x000000000584A000-memory.dmp
        Download