Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-10-2024 21:04
General
-
Target
Payload31.exe
-
Size
55KB
-
MD5
8b3b84f75b3a92bf66565261f9432be9
-
SHA1
897455084ef6180f656e1457e258361298c43f3b
-
SHA256
b944c5a6158aca462026ee93375598b1f46a2636aee82c4d44e0ce5a425f0aa0
-
SHA512
ebbcb92978241314e6444a2e10798d0a9b269b74156e654453a01532840c4ea94fe0ed1ceff1ee6f6e638dacc80cdf8f7bae24264da73810ef5767add6946583
-
SSDEEP
1536:sGLu8DnN8N1+S1Cl/BODtwsNMDtXExI3pmEm:a8DnNGcXODtwsNMDtXExI3pm
Score
10/10
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload31.exe"C:\Users\Admin\AppData\Local\Temp\Payload31.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB