Analysis Overview
SHA256
23d041615509c122bc7ecebae1a6ccc7c92d1cd8ac166904e98a030c271a5d16
Threat Level: Known bad
The file Server.exe was found to be: Known bad.
Malicious Activity Summary
njRAT/Bladabindi
Njrat family
Modifies Windows Firewall
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Drops startup file
Adds Run key to start application
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-07-27 17:04
Signatures
Njrat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-27 17:04
Reported
2024-07-27 17:05
Platform
win7-20240704-en
Max time kernel
32s
Max time network
20s
Command Line
Signatures
njRAT/Bladabindi
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e9ca6907ecb9894c8165310b4f83b54.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e9ca6907ecb9894c8165310b4f83b54.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Server.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\9e9ca6907ecb9894c8165310b4f83b54 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Testing.exe\" .." | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9e9ca6907ecb9894c8165310b4f83b54 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Testing.exe\" .." | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\Server.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\Server.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
| Token: 33 | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
| Token: 33 | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2380 wrote to memory of 560 | N/A | C:\Users\Admin\AppData\Local\Temp\Server.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe |
| PID 2380 wrote to memory of 560 | N/A | C:\Users\Admin\AppData\Local\Temp\Server.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe |
| PID 2380 wrote to memory of 560 | N/A | C:\Users\Admin\AppData\Local\Temp\Server.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe |
| PID 2380 wrote to memory of 560 | N/A | C:\Users\Admin\AppData\Local\Temp\Server.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe |
| PID 560 wrote to memory of 2912 | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | C:\Windows\SysWOW64\netsh.exe |
| PID 560 wrote to memory of 2912 | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | C:\Windows\SysWOW64\netsh.exe |
| PID 560 wrote to memory of 2912 | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | C:\Windows\SysWOW64\netsh.exe |
| PID 560 wrote to memory of 2912 | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | C:\Windows\SysWOW64\netsh.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
C:\Users\Admin\AppData\Local\Temp\Testing.exe
"C:\Users\Admin\AppData\Local\Temp\Testing.exe"
C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Testing.exe" "Testing.exe" ENABLE
C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp |
Files
memory/2380-0-0x0000000074B51000-0x0000000074B52000-memory.dmp
memory/2380-1-0x0000000074B50000-0x00000000750FB000-memory.dmp
memory/2380-2-0x0000000074B50000-0x00000000750FB000-memory.dmp
memory/2560-3-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/2560-4-0x0000000140000000-0x00000001405E8000-memory.dmp
\Users\Admin\AppData\Local\Temp\Testing.exe
| MD5 | eefce7d017206bb0427ddec59dce0c24 |
| SHA1 | c588ceb9388eecabd9eaded2a4791a433dc0f617 |
| SHA256 | 23d041615509c122bc7ecebae1a6ccc7c92d1cd8ac166904e98a030c271a5d16 |
| SHA512 | b7e66ee0a1a090f866e584ba0eefe7424072a306b00f9817fabc882325012218477905105dbc52cfa89bcf2bdecd7fb27c29566da3177072bf7486e3d842bfab |
memory/2380-12-0x0000000074B50000-0x00000000750FB000-memory.dmp
memory/2560-13-0x00000000001A0000-0x00000000001B0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-27 17:04
Reported
2024-07-27 17:07
Platform
win10v2004-20240709-en
Max time kernel
150s
Max time network
136s
Command Line
Signatures
njRAT/Bladabindi
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Server.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e9ca6907ecb9894c8165310b4f83b54.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e9ca6907ecb9894c8165310b4f83b54.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9e9ca6907ecb9894c8165310b4f83b54 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Testing.exe\" .." | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9e9ca6907ecb9894c8165310b4f83b54 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Testing.exe\" .." | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\Server.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\Testing.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\netsh.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3000 wrote to memory of 4504 | N/A | C:\Users\Admin\AppData\Local\Temp\Server.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe |
| PID 3000 wrote to memory of 4504 | N/A | C:\Users\Admin\AppData\Local\Temp\Server.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe |
| PID 3000 wrote to memory of 4504 | N/A | C:\Users\Admin\AppData\Local\Temp\Server.exe | C:\Users\Admin\AppData\Local\Temp\Testing.exe |
| PID 4504 wrote to memory of 1908 | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | C:\Windows\SysWOW64\netsh.exe |
| PID 4504 wrote to memory of 1908 | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | C:\Windows\SysWOW64\netsh.exe |
| PID 4504 wrote to memory of 1908 | N/A | C:\Users\Admin\AppData\Local\Temp\Testing.exe | C:\Windows\SysWOW64\netsh.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
C:\Users\Admin\AppData\Local\Temp\Testing.exe
"C:\Users\Admin\AppData\Local\Temp\Testing.exe"
C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Testing.exe" "Testing.exe" ENABLE
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:5552 | tcp | |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.142.123.92.in-addr.arpa | udp |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp | |
| N/A | 127.0.0.1:5552 | tcp |
Files
memory/3000-0-0x0000000075482000-0x0000000075483000-memory.dmp
memory/3000-1-0x0000000075480000-0x0000000075A31000-memory.dmp
memory/3000-2-0x0000000075480000-0x0000000075A31000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Testing.exe
| MD5 | eefce7d017206bb0427ddec59dce0c24 |
| SHA1 | c588ceb9388eecabd9eaded2a4791a433dc0f617 |
| SHA256 | 23d041615509c122bc7ecebae1a6ccc7c92d1cd8ac166904e98a030c271a5d16 |
| SHA512 | b7e66ee0a1a090f866e584ba0eefe7424072a306b00f9817fabc882325012218477905105dbc52cfa89bcf2bdecd7fb27c29566da3177072bf7486e3d842bfab |
memory/4504-11-0x0000000075480000-0x0000000075A31000-memory.dmp
memory/4504-12-0x0000000075480000-0x0000000075A31000-memory.dmp
memory/4504-14-0x0000000075480000-0x0000000075A31000-memory.dmp
memory/3000-15-0x0000000075480000-0x0000000075A31000-memory.dmp
memory/4504-17-0x0000000075480000-0x0000000075A31000-memory.dmp