Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 08:01
General
-
Target
61ae4aea70d5e2c89c5f4c77453a158a.exe
-
Size
123KB
-
MD5
61ae4aea70d5e2c89c5f4c77453a158a
-
SHA1
be19c1e5f3d36df7b4f1bfd5c88465f7c1f124c4
-
SHA256
76618841b8ca047be4e3985b65b33f284e92446c774df127aa5f584fa38a48f6
-
SHA512
f0fa9452a8256e8a4784bcca2518e0b8faefcbbabd4e9bd517a66b820bcecf59da9455c170adce1ded19100baf4ce43e016b78be45a7af883b09cf1f79387a8e
-
SSDEEP
3072:vqGlYGCqI9Z5JC6wiM+LhwlwqzIwgxBANC:yGDW9ZXCdvdKqzIg
Score
10/10
Malware Config
Extracted
Family
njrat
Version
im523
Botnet
HacKed
C2
19.ip.gl.ply.gg:42443
Mutex
c1f77453d4f3d154f8c1eedb0473faf9
Attributes
-
reg_key
c1f77453d4f3d154f8c1eedb0473faf9
-
splitter
|'|'|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61ae4aea70d5e2c89c5f4c77453a158a.exe"C:\Users\Admin\AppData\Local\Temp\61ae4aea70d5e2c89c5f4c77453a158a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\61ae4aea70d5e2c89c5f4c77453a158a.exe" "61ae4aea70d5e2c89c5f4c77453a158a.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
664KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
392KB
-
Filesize
9.6MB
-
Filesize
9.6MB