Analysis
-
max time kernel
37s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/11/2024, 09:22
Errors
General
-
Target
e1fdf894780ccf149939a72dffb6e8046ac62810fda22a8c8bab0f4fe0bbf70b.exe
-
Size
103KB
-
MD5
61fd98dbc93dae448c37f01db0724adc
-
SHA1
92e9d04549511a5fd92f1c3dc3b6e14bdd7d30a6
-
SHA256
e1fdf894780ccf149939a72dffb6e8046ac62810fda22a8c8bab0f4fe0bbf70b
-
SHA512
cf3b513b9a02ed4f10df583bc083898b96b565fbd5dc8164ce0a38de10f53c6f0416178b54e63337f5b099b6d981fa73a548544345b870ffb68317262ae88f2f
-
SSDEEP
1536:J7SbmW9xXfy0AeX9kSNvnyY21oFhWzc9PkykrIxFZEb8t/FT:J7SbJ9ZX9kqKY21Bqk0Zf
Malware Config
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1fdf894780ccf149939a72dffb6e8046ac62810fda22a8c8bab0f4fe0bbf70b.exe"C:\Users\Admin\AppData\Local\Temp\e1fdf894780ccf149939a72dffb6e8046ac62810fda22a8c8bab0f4fe0bbf70b.exe"1⤵
- Checks computer location settings
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "penis" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/e1fdf894780ccf149939a72dffb6e8046ac62810fda22a8c8bab0f4fe0bbf70b.exe"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5e2fe910f4f3d3e8d9499801d3bfcfba4
SHA1e0fe5d74d92d71b25ce4dcb2c421156a7c00ea32
SHA2562c5e993afa6138ad26a5136f35cac30fc007bfc7fd961565de477b03c10d3a98
SHA51207790396def8a1718a6617e0182d99167b7759c27165508df64638ef9fb95f055cf521365d538266f7039ca59054590fa8238355433accce91f20c1eaecfc568
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
7.7MB