Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-09-2024 15:36

General

  • Target

    2236cf20c22202d6ed6fd145e71aed609d157928b403aa5512ce57214146d210.exe

  • Size

    882KB

  • MD5

    b062843886327f817d7cefb5f611a15e

  • SHA1

    cdfab7d0a25683e0a5c78646f8ab01a66ce68b0a

  • SHA256

    2236cf20c22202d6ed6fd145e71aed609d157928b403aa5512ce57214146d210

  • SHA512

    15912eb2fc004c8b39b5b087c91b60554ca6c34e43ddf8688e8d36dac657c0186608142899d779e592ad24d38fc3314a10155175e0a3b9b5ece48d8d788c6d56

  • SSDEEP

    12288:G4lsXvtCcmVVXzzn4PJAahPl/QEdIMiVbHydEIJnJWUgahFWkq9MmCS:G4lavt0LkLL9IMixoEgeahFWkq9MmCS

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2236cf20c22202d6ed6fd145e71aed609d157928b403aa5512ce57214146d210.exe
    "C:\Users\Admin\AppData\Local\Temp\2236cf20c22202d6ed6fd145e71aed609d157928b403aa5512ce57214146d210.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4768
    • C:\Users\Admin\AppData\Local\Temp\2048\2048.exe
      "C:\Users\Admin\AppData\Local\Temp\2048\2048.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:212
      • C:\Users\Admin\AppData\Local\Temp\jack.exe
        "C:\Users\Admin\AppData\Local\Temp\jack.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3500
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\jack.exe" "jack.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3704
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3884,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
    1⤵
      PID:1144

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\2048\2048.exe

      Filesize

      23KB

      MD5

      3dd0064c834ec42bacd2542200113d09

      SHA1

      6663d0a358f07e04f0918f4af7152ec5649c9219

      SHA256

      9ebf34a1b3064f26e2e41b137920e8628c218033a3afb61a49eb55c6ad9f3d31

      SHA512

      ecadc6b4062bb0b3a756f19131aeb54f076c38d8eb7d3e7ff8e9a03e57adace3c776a4d1acf79669150bf4e9d0f779a67a22c3cb45d2944e399229532ad15c88

    • memory/212-20-0x0000000073702000-0x0000000073703000-memory.dmp

      Filesize

      4KB

    • memory/212-21-0x0000000073700000-0x0000000073CB1000-memory.dmp

      Filesize

      5.7MB

    • memory/212-22-0x0000000073700000-0x0000000073CB1000-memory.dmp

      Filesize

      5.7MB

    • memory/212-32-0x0000000073700000-0x0000000073CB1000-memory.dmp

      Filesize

      5.7MB

    • memory/3500-33-0x0000000073700000-0x0000000073CB1000-memory.dmp

      Filesize

      5.7MB

    • memory/3500-34-0x0000000073700000-0x0000000073CB1000-memory.dmp

      Filesize

      5.7MB

    • memory/3500-35-0x0000000073700000-0x0000000073CB1000-memory.dmp

      Filesize

      5.7MB

    • memory/3500-37-0x0000000073700000-0x0000000073CB1000-memory.dmp

      Filesize

      5.7MB