Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-09-2024 13:46
General
-
Target
b8a92e0ec11d91aaa6c5c44f37024d9f09071623dcf2aa67462189e84f683b65.exe
-
Size
25KB
-
MD5
ee2daced77768d937294aaf656c59e81
-
SHA1
643fc628eb908d845c2c275492c232f39b0e56d5
-
SHA256
b8a92e0ec11d91aaa6c5c44f37024d9f09071623dcf2aa67462189e84f683b65
-
SHA512
9487fe759220b3c6ac22941a94fe4bbd37896ee30a06a0d5789d693a870ed2055cf6506233a75c2266fd605e27aea35e218de72653bd76d39061ceff14e3795d
-
SSDEEP
384:5vcTzwCNCC7GepiEQceFsJoFbiOVg3Cynm6Ld2UTLrFEn768hkfH7+NpgBemOdqt:5vkHwCr89Fski7hm6L8O27U+oBLkq2M
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
Kulum
34.89.221.19:3131
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8a92e0ec11d91aaa6c5c44f37024d9f09071623dcf2aa67462189e84f683b65.exe"C:\Users\Admin\AppData\Local\Temp\b8a92e0ec11d91aaa6c5c44f37024d9f09071623dcf2aa67462189e84f683b65.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\systemupdate.exe"C:\Users\Admin\AppData\Roaming\systemupdate.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5ee2daced77768d937294aaf656c59e81
SHA1643fc628eb908d845c2c275492c232f39b0e56d5
SHA256b8a92e0ec11d91aaa6c5c44f37024d9f09071623dcf2aa67462189e84f683b65
SHA5129487fe759220b3c6ac22941a94fe4bbd37896ee30a06a0d5789d693a870ed2055cf6506233a75c2266fd605e27aea35e218de72653bd76d39061ceff14e3795d
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
664KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB