Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 02:05
General
-
Target
d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7.exe
-
Size
31KB
-
MD5
d16886dc04d9ce85c604088c886b8fd5
-
SHA1
49653245efb1cfe5eee9b3452bb83c6718ba5c2f
-
SHA256
d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7
-
SHA512
b1bfa78a37e9e8a957c8ff4203f607e952dfa46e0ff3d22706e0d3d44c10f60a2f24f73559d63c5ad919b06b71920b79f8c6b4fad92d57ff8e49c9732f2f82fc
-
SSDEEP
768:njMXjwpJbb2zxxO56eqvPisfv8yQmIDUu0tiWmj:ikKdisvQVkQj
Score
10/10
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7.exe"C:\Users\Admin\AppData\Local\Temp\d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7.exe" "d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7.exe" ENABLE2⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1192-0-0x0000000075012000-0x0000000075013000-memory.dmpFilesize
4KB
-
memory/1192-1-0x0000000075010000-0x00000000755C1000-memory.dmpFilesize
5.7MB
-
memory/1192-2-0x0000000075010000-0x00000000755C1000-memory.dmpFilesize
5.7MB
-
memory/1192-3-0x0000000075012000-0x0000000075013000-memory.dmpFilesize
4KB
-
memory/1192-4-0x0000000075010000-0x00000000755C1000-memory.dmpFilesize
5.7MB