Analysis
-
max time kernel
117s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/09/2024, 06:53 UTC
General
-
Target
0da0698beb4c1f1ca6a24dcb2776e8ad47399ffb1faeaa3b6f207838ff564e7bN.exe
-
Size
55KB
-
MD5
563cfd7cc9c80650d3fc036b40cd5020
-
SHA1
ad902fe07dd8e65b55b3dd99376fff44fe2d7faa
-
SHA256
0da0698beb4c1f1ca6a24dcb2776e8ad47399ffb1faeaa3b6f207838ff564e7b
-
SHA512
6d4a3d8d31fc199f76615a066a715dbbab5b185611c1a46843245a2ac069cfa35aed9aa7d41c46271f45a8b6febff2a8d8635ba24ef9cbea10aecc4f18d45496
-
SSDEEP
1536:jGCoDns0NiiSx1YDtwsNMDsXExI3pmem:joDnwXTYDtwsNMDsXExI3pm
Score
10/10
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0da0698beb4c1f1ca6a24dcb2776e8ad47399ffb1faeaa3b6f207838ff564e7bN.exe"C:\Users\Admin\AppData\Local\Temp\0da0698beb4c1f1ca6a24dcb2776e8ad47399ffb1faeaa3b6f207838ff564e7bN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
-
DNSgman1.ddns.netRemote address:8.8.8.8:53Requestgman1.ddns.netIN AResponsegman1.ddns.netIN A41.102.20.40 -
DNSgman1.ddns.netRemote address:8.8.8.8:53Requestgman1.ddns.netIN AResponsegman1.ddns.netIN A41.102.20.40
-
41.102.20.40:5552gman1.ddns.net -
41.102.20.40:5552gman1.ddns.net
-
41.102.20.40:5552gman1.ddns.net
-
41.102.20.40:5552gman1.ddns.net
-
41.102.20.40:5552gman1.ddns.net
-
8.8.8.8:53gman1.ddns.netdns
DNS Request
gman1.ddns.net
DNS Response
41.102.20.40
-
8.8.8.8:53gman1.ddns.netdns
DNS Request
gman1.ddns.net
DNS Response
41.102.20.40
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB