Analysis

  • max time kernel
    125s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-06-2024 10:01

General

  • Target

    crypted rat.exe

  • Size

    110KB

  • MD5

    c5095088e4ce78d1a90224a2c769e196

  • SHA1

    0dce6ff26e150acd9dd9b9838068011c71b90a3b

  • SHA256

    286fd81b6bae4e132cbad308423e3b2b064ea4e8b4ea970c5c1fe31a156c5b1e

  • SHA512

    954cceb8006bcd76f03ec7781898a318b7bbcf447501bfbfd7c5902e1a4945df7edcc1b2c3c7a0d19648b28384e87fc47995dceb481fccf4683c07a66a1411c4

  • SSDEEP

    3072:abnaOa/AhYN7ofWE9kI93IcakRGEV8IbEWOEx:azssY1ofj9593JRb5xb

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Debil

C2

hakim32.ddns.net:2000

lake-french.gl.at.ply.gg:33694

Mutex

5d215efb685d488d29cc52d66504493b

Attributes
  • reg_key

    5d215efb685d488d29cc52d66504493b

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\crypted rat.exe
    "C:\Users\Admin\AppData\Local\Temp\crypted rat.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:3708
      • C:\Windows\server.exe
        "C:\Windows\server.exe"
        3⤵
        • Executes dropped EXE
        PID:2576
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
    1⤵
      PID:1804

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\server.exe

      Filesize

      44KB

      MD5

      9d352bc46709f0cb5ec974633a0c3c94

      SHA1

      1969771b2f022f9a86d77ac4d4d239becdf08d07

      SHA256

      2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

      SHA512

      13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

    • memory/628-10-0x0000000005AA0000-0x0000000005ABE000-memory.dmp

      Filesize

      120KB

    • memory/628-3-0x0000000005800000-0x0000000005892000-memory.dmp

      Filesize

      584KB

    • memory/628-1-0x0000000000DD0000-0x0000000000DF2000-memory.dmp

      Filesize

      136KB

    • memory/628-4-0x00000000057F0000-0x00000000057FA000-memory.dmp

      Filesize

      40KB

    • memory/628-5-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/628-6-0x0000000005B20000-0x0000000005B96000-memory.dmp

      Filesize

      472KB

    • memory/628-7-0x000000007480E000-0x000000007480F000-memory.dmp

      Filesize

      4KB

    • memory/628-8-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/628-15-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/628-0-0x000000007480E000-0x000000007480F000-memory.dmp

      Filesize

      4KB

    • memory/628-9-0x00000000058A0000-0x00000000058C0000-memory.dmp

      Filesize

      128KB

    • memory/628-2-0x0000000005E90000-0x0000000006434000-memory.dmp

      Filesize

      5.6MB

    • memory/2576-36-0x00000000747D0000-0x000000007487B000-memory.dmp

      Filesize

      684KB

    • memory/2576-32-0x00000000747D0000-0x000000007487B000-memory.dmp

      Filesize

      684KB

    • memory/2576-31-0x0000000000640000-0x000000000064E000-memory.dmp

      Filesize

      56KB

    • memory/2576-33-0x0000000004E20000-0x0000000004E5C000-memory.dmp

      Filesize

      240KB

    • memory/2576-34-0x0000000002960000-0x0000000002981000-memory.dmp

      Filesize

      132KB

    • memory/3708-13-0x00000000053D0000-0x000000000546C000-memory.dmp

      Filesize

      624KB

    • memory/3708-16-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3708-14-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3708-29-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3708-11-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB