Overview

overview

10

Static

static

3

svchost.exe

windows10-2004-x64

10

svchost.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23-05-2024 18:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchost.exe

  • Size

    1.1MB

  • MD5

    5bf9ee7d92c033665bbbe4cc83c6c8bd

  • SHA1

    e763e34f50c83e1cf8c4be632993b8cec2ed193e

  • SHA256

    f7ca25eb2280d864435398259c502fe3dac6797871d8d1e9d362a889419c5cf4

  • SHA512

    f3026e908adf75147bfef7737bcf98701118ea310a0b93b9c04369656572e1c3f43f6a2a2fe61a31a0f66d2b59d6a74ca4efc5528a65ac64784b6aa8b7472448

  • SSDEEP

    24576:EQlWF5PC5xcbIdo20hVV58hCXeFnnw0uR7DF8A+dIJtFwwGf3xx7BzU:jnxcbOo28PeFcR7DF8YbGfL7BQ

Score
10/10
njratevasionpersistencetrojan

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
    evasion
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3504
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:4480
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /F /IM MsMpEng.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1336
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Modifies Windows Firewall
        PID:5052
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /k ping 0 & del "C:\Users\Admin\AppData\Roaming\svchost.exe" & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\SysWOW64\PING.EXE
          ping 0
          4⤵
          • Runs ping.exe
          PID:2352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svchost.exe.log
    Filesize

    319B

    MD5

    2a0834560ed3770fc33d7a42f8229722

    SHA1

    c8c85f989e7a216211cf9e4ce90b0cc95354aa53

    SHA256

    8aa2d836004258f1a1195dc4a96215b685aed0c46a261a2860625d424e9402b6

    SHA512

    c5b64d84e57eb8cc387b5feedf7719f1f7ae21f6197169f5f73bc86deddb538b9af3c9952c94c4f69ae956e1656d11ab7441c292d2d850a4d2aaa9ec678f8e82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svchost.exe
    Filesize

    1.1MB

    MD5

    5bf9ee7d92c033665bbbe4cc83c6c8bd

    SHA1

    e763e34f50c83e1cf8c4be632993b8cec2ed193e

    SHA256

    f7ca25eb2280d864435398259c502fe3dac6797871d8d1e9d362a889419c5cf4

    SHA512

    f3026e908adf75147bfef7737bcf98701118ea310a0b93b9c04369656572e1c3f43f6a2a2fe61a31a0f66d2b59d6a74ca4efc5528a65ac64784b6aa8b7472448

    Download Submit

  • memory/2144-18-0x0000000073CA0000-0x0000000074251000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2144-12-0x0000000000D50000-0x00000000010C6000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/2144-17-0x0000000073CA0000-0x0000000074251000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2144-22-0x0000000000D50000-0x00000000010C6000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/2144-23-0x0000000073CA0000-0x0000000074251000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2144-27-0x0000000073CA0000-0x0000000074251000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2144-28-0x0000000000D50000-0x00000000010C6000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/3504-2-0x0000000073CA0000-0x0000000074251000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3504-14-0x0000000000B90000-0x0000000000F06000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/3504-15-0x0000000073CA0000-0x0000000074251000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3504-1-0x0000000073CA1000-0x0000000073CA2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3504-0-0x0000000000B90000-0x0000000000F06000-memory.dmp

    Filesize

    3.5MB

    Download