Overview

overview

10

Static

static

3

3fed82eee5...43.exe

windows7-x64

10

3fed82eee5...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 01:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    3fed82eee5314ec6282be309f63582b1a3ad0d334e048f973d7fe832ff3fe943.exe

  • Size

    329KB

  • MD5

    9d509cf97138b882335dd50f0a0c34d9

  • SHA1

    3ad0963d838afe0a59d2bd42890b7ff033910cf6

  • SHA256

    3fed82eee5314ec6282be309f63582b1a3ad0d334e048f973d7fe832ff3fe943

  • SHA512

    67e83ea00bf2e291648fd4a017f566fde4592c19d6a09d67ee097c907aa6cfaa36085ea2dcdf6ef0ff6888453fc496a0c48298414cd07096a1b20e0eb66290d0

  • SSDEEP

    6144:+AAeB34B2Dh19wMY8o/WNOKXOdFefVbYuRpANbhIDeP:+i3XwDON+oG0pD8

Score
10/10
njrathackeddefense_evasionevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

beeoann.hackcrack.io:32949

Mutex

WMI Provider Host

Attributes
  • reg_key

    WMI Provider Host

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Run Powershell and hide display window.

    execution
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Hide Artifacts: Hidden Window 1 TTPs 8 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fed82eee5314ec6282be309f63582b1a3ad0d334e048f973d7fe832ff3fe943.exe
    "C:\Users\Admin\AppData\Local\Temp\3fed82eee5314ec6282be309f63582b1a3ad0d334e048f973d7fe832ff3fe943.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2240
    • \??\c:\windows\system32\cmstp.exe
      "c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\f1wr550z.inf
      2⤵
        PID:1440
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:2332
        • C:\Windows\SYSTEM32\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe" "WmiPrvSE.exe" ENABLE
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4732
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3628
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
        2⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:3340
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:3212
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
        2⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:3444
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
        2⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:3936
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:1688
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
        2⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:2956
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:4352
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
        2⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:3400
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
        2⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:1244
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:824
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
        2⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:4364
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
        2⤵
        • Hide Artifacts: Hidden Window
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:3996
    • C:\Windows\system32\taskkill.exe
      taskkill /IM cmstp.exe /F
      1⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4596

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Window

          1
          T1564.003

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            2e907f77659a6601fcc408274894da2e

            SHA1

            9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

            SHA256

            385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

            SHA512

            34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            d28a889fd956d5cb3accfbaf1143eb6f

            SHA1

            157ba54b365341f8ff06707d996b3635da8446f7

            SHA256

            21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

            SHA512

            0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_henande4.yo4.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\f1wr550z.inf
            Filesize

            619B

            MD5

            6f1420f2133f3e08fd8cdea0e1f5fe27

            SHA1

            3aa41ec75adc0cf50e001ca91bbfa7f763adf70b

            SHA256

            aed1ac2424a255f231168bcb02f16b6ea89603e0045465c2149abcde33a06242

            SHA512

            d5629e9835f881cd271e88d9ec2d2c27b9d5d1b25329ade5cfb9824a6358c9e98e66f1b89ac9459b4c540c02af2728129dd8523bdf007cadf28b5fa2d199a2aa

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\WmiPrvSE.exe
            Filesize

            329KB

            MD5

            9d509cf97138b882335dd50f0a0c34d9

            SHA1

            3ad0963d838afe0a59d2bd42890b7ff033910cf6

            SHA256

            3fed82eee5314ec6282be309f63582b1a3ad0d334e048f973d7fe832ff3fe943

            SHA512

            67e83ea00bf2e291648fd4a017f566fde4592c19d6a09d67ee097c907aa6cfaa36085ea2dcdf6ef0ff6888453fc496a0c48298414cd07096a1b20e0eb66290d0

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
            Filesize

            46KB

            MD5

            c9ee90b6246b82685a26af067eada50c

            SHA1

            247dcdc29bdf134535c0142bc22a0a15e1033c28

            SHA256

            d9402ee82fb2cfc8965666cf3157bdf39547838814189106d565541522b8335e

            SHA512

            de676e0a7af1e59e2fd25393a976223414e6ee378f2607a409a00b37283800bacff0fd4393fca4cc53bbe1915ed46f775557a61134281aecbc27f9d98f66bb28

            Download Submit

          • memory/2240-14-0x0000000000D90000-0x0000000000D9C000-memory.dmp

            Filesize

            48KB

            Download

          • memory/2240-3-0x000000001B560000-0x000000001B606000-memory.dmp

            Filesize

            664KB

            Download

          • memory/2240-10-0x0000000000C60000-0x0000000000C68000-memory.dmp

            Filesize

            32KB

            Download

          • memory/2240-0-0x00007FFA7AF05000-0x00007FFA7AF06000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2240-11-0x00007FFA7AC50000-0x00007FFA7B5F1000-memory.dmp

            Filesize

            9.6MB

            Download

          • memory/2240-123-0x00007FFA7AC50000-0x00007FFA7B5F1000-memory.dmp

            Filesize

            9.6MB

            Download

          • memory/2240-1-0x00007FFA7AC50000-0x00007FFA7B5F1000-memory.dmp

            Filesize

            9.6MB

            Download

          • memory/2240-2-0x00007FFA7AC50000-0x00007FFA7B5F1000-memory.dmp

            Filesize

            9.6MB

            Download

          • memory/2240-9-0x000000001B960000-0x000000001B9FC000-memory.dmp

            Filesize

            624KB

            Download

          • memory/2240-6-0x000000001BF60000-0x000000001C42E000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/3400-25-0x0000025DB1590000-0x0000025DB15B2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/3628-15-0x00007FFA7AC50000-0x00007FFA7B5F1000-memory.dmp

            Filesize

            9.6MB

            Download

          • memory/3628-19-0x00007FFA7AC50000-0x00007FFA7B5F1000-memory.dmp

            Filesize

            9.6MB

            Download

          • memory/3628-17-0x00007FFA7AC50000-0x00007FFA7B5F1000-memory.dmp

            Filesize

            9.6MB

            Download

          • memory/3628-16-0x00007FFA7AC50000-0x00007FFA7B5F1000-memory.dmp

            Filesize

            9.6MB

            Download