Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-10-2024 00:13
General
-
Target
8760a9a669f5c298dbb04ff38fe8bfa72036fd093c8f5f2ee137ae02703c216a.exe
-
Size
59KB
-
MD5
b605dd61f05028f5f48fbc2c8170273e
-
SHA1
9e452f6adfefc5e07d5f6800137fa3f2ae7156b5
-
SHA256
8760a9a669f5c298dbb04ff38fe8bfa72036fd093c8f5f2ee137ae02703c216a
-
SHA512
c12da2b928dad93eb2d6d614f216f33f7baf0dcb83ec6ec13df1dc9db2466f98b1d14bce361941d9a179e9f4028171e660f6b8f4ba13358ba3b442aac5de79b4
-
SSDEEP
1536:t00NjIXChbP8Nm82Uuw5tnvvyTC7mVcl:60S2bPwmRw5ZOC78Y
Malware Config
Extracted
njrat
0.7d
mohib
127.0.0.1:1978
a0b72362103f09d1b009d939c194f0ce
-
reg_key
a0b72362103f09d1b009d939c194f0ce
-
splitter
|'|'|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 34 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8760a9a669f5c298dbb04ff38fe8bfa72036fd093c8f5f2ee137ae02703c216a.exe"C:\Users\Admin\AppData\Local\Temp\8760a9a669f5c298dbb04ff38fe8bfa72036fd093c8f5f2ee137ae02703c216a.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\explorer.exe" "explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5b605dd61f05028f5f48fbc2c8170273e
SHA19e452f6adfefc5e07d5f6800137fa3f2ae7156b5
SHA2568760a9a669f5c298dbb04ff38fe8bfa72036fd093c8f5f2ee137ae02703c216a
SHA512c12da2b928dad93eb2d6d614f216f33f7baf0dcb83ec6ec13df1dc9db2466f98b1d14bce361941d9a179e9f4028171e660f6b8f4ba13358ba3b442aac5de79b4
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB