Overview

overview

10

Static

static

10

ce99437aca...3N.exe

windows7-x64

10

ce99437aca...3N.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ce99437aca8f29cb5e6ac392b376456be01fd3ce5b7820f0647d5f5f363c1f93N

  • Size

    36KB

  • Sample

    241001-fsaawssbll

  • MD5

    93e930cadd8eadca42a73e0abedf1d60

  • SHA1

    7507ba75071929c81e4ebf84b60755a5acfb9148

  • SHA256

    ce99437aca8f29cb5e6ac392b376456be01fd3ce5b7820f0647d5f5f363c1f93

  • SHA512

    a60cbd59af079f4852f7e1cef7da9405a294eb70bc5e75eb279eb7d9b1273c5818e5f3349205c0be5c639bb17d5bf667f10036cd52447abf225f38dec2272e8b

  • SSDEEP

    768:VOSkaDm6H8T3q+8cUTizxI/MJsEhq5lxOBcmZPt06PjC:VOSkaDFu3q+8cUTi+/V5lxOWmM62

Score
10/10
njratdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      ce99437aca8f29cb5e6ac392b376456be01fd3ce5b7820f0647d5f5f363c1f93N

    • Size

      36KB

    • MD5

      93e930cadd8eadca42a73e0abedf1d60

    • SHA1

      7507ba75071929c81e4ebf84b60755a5acfb9148

    • SHA256

      ce99437aca8f29cb5e6ac392b376456be01fd3ce5b7820f0647d5f5f363c1f93

    • SHA512

      a60cbd59af079f4852f7e1cef7da9405a294eb70bc5e75eb279eb7d9b1273c5818e5f3349205c0be5c639bb17d5bf667f10036cd52447abf225f38dec2272e8b

    • SSDEEP

      768:VOSkaDm6H8T3q+8cUTizxI/MJsEhq5lxOBcmZPt06PjC:VOSkaDFu3q+8cUTi+/V5lxOWmM62

    Score
    10/10
    njratdiscoveryevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks