Analysis Overview
SHA256
e68a7d3b10a0173996dbf302d4d9d313ddeea5c90095623aceba1cefe957c787
Threat Level: Known bad
The file instell.exe was found to be: Known bad.
Malicious Activity Summary
njRAT/Bladabindi
Unsigned PE
Suspicious behavior: GetForegroundWindowSpam
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-08-25 18:23
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-25 18:23
Reported
2024-08-25 18:24
Platform
win7-20240704-en
Max time kernel
0s
Max time network
6s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\instell.exe
"C:\Users\Admin\AppData\Local\Temp\instell.exe"
Network
Files
memory/760-0-0x000007FEF630E000-0x000007FEF630F000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-25 18:23
Reported
2024-08-25 18:24
Platform
win10v2004-20240802-en
Max time kernel
9s
Max time network
11s
Command Line
Signatures
njRAT/Bladabindi
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\instell.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\instell.exe
"C:\Users\Admin\AppData\Local\Temp\instell.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.140.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | friend-tr.gl.at.ply.gg | udp |
| US | 147.185.221.22:19892 | friend-tr.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | 22.221.185.147.in-addr.arpa | udp |
Files
memory/4128-0-0x00007FFA4A425000-0x00007FFA4A426000-memory.dmp
memory/4128-2-0x000000001B6E0000-0x000000001BBAE000-memory.dmp
memory/4128-1-0x00007FFA4A170000-0x00007FFA4AB11000-memory.dmp
memory/4128-3-0x0000000000B40000-0x0000000000B52000-memory.dmp
memory/4128-4-0x000000001BBB0000-0x000000001BC56000-memory.dmp
memory/4128-5-0x00007FFA4A170000-0x00007FFA4AB11000-memory.dmp
memory/4128-6-0x000000001BF00000-0x000000001BF9C000-memory.dmp
memory/4128-7-0x0000000000B50000-0x0000000000B58000-memory.dmp
memory/4128-9-0x00007FFA4A170000-0x00007FFA4AB11000-memory.dmp
memory/4128-8-0x00007FFA4A425000-0x00007FFA4A426000-memory.dmp
memory/4128-10-0x000000001C990000-0x000000001C9F2000-memory.dmp
memory/4128-11-0x000000001D260000-0x000000001D279000-memory.dmp