Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
- submitted
13/06/2024, 04:34
General
- Target Nursultan1.16.5.exe
- Size 43KB
- Sample240613-e7bxlaxhlm
- SHA256 9a9f2e963c5e9c001b6b6b730971ef363a337814abeeb1b42ccf960d7d34847c
Malware Config
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
HacKed
-
christian-printed.gl.at.ply.gg:21472
-
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 33 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nursultan1.16.5.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan1.16.5.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Server.exe.log
Server.exe
memory/3648-3-0x0000000005C10000-0x00000000061B6000-memory.dmp
memory/3648-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp
memory/3648-4-0x0000000005760000-0x00000000057F2000-memory.dmp
memory/3648-5-0x0000000074AC0000-0x0000000075271000-memory.dmp
memory/3648-7-0x0000000005650000-0x000000000565A000-memory.dmp
memory/3648-8-0x0000000074ACE000-0x0000000074ACF000-memory.dmp
memory/3648-9-0x0000000074AC0000-0x0000000075271000-memory.dmp
memory/3648-2-0x00000000053A0000-0x000000000543C000-memory.dmp
memory/3648-1-0x00000000008C0000-0x00000000008D2000-memory.dmp
memory/4100-12-0x0000000074AC0000-0x0000000075271000-memory.dmp
memory/4100-13-0x0000000074AC0000-0x0000000075271000-memory.dmp
memory/4100-15-0x0000000074AC0000-0x0000000075271000-memory.dmp