Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2024, 19:49 UTC

General

  • Target

    606f3743352d22f589b94dfa845d2ec06fe6f655791b47e415ff8f234926c8e2N.exe

  • Size

    100KB

  • MD5

    4d777e7464920e953ff9ccc1e21ac320

  • SHA1

    14effc2633d29c55c0ff8ef09359eca07c29a49f

  • SHA256

    606f3743352d22f589b94dfa845d2ec06fe6f655791b47e415ff8f234926c8e2

  • SHA512

    2916d173f01bebdc5df5a0447e8a5a6cf7c0680bfda37e61d7ce2cfe834554143eee04930057b48e7e9ea511fdd41af5be16c93ffacbbef9101d745398ac1a30

  • SSDEEP

    3072:86IB+CLX3g0visO6/DWJ0cB7BTKJpkYHwR6wBF:86IBZ3g0v467WJ0cB7ekYHwHX

Malware Config

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\606f3743352d22f589b94dfa845d2ec06fe6f655791b47e415ff8f234926c8e2N.exe
    "C:\Users\Admin\AppData\Local\Temp\606f3743352d22f589b94dfa845d2ec06fe6f655791b47e415ff8f234926c8e2N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4928

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    92.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    92.12.20.2.in-addr.arpa
    IN PTR
    Response
    92.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-92deploystaticakamaitechnologiescom
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    74.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    74.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    98.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    98.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
  • flag-us
    DNS
    yerda22.ddns.net
    server.exe
    Remote address:
    8.8.8.8:53
    Request
    yerda22.ddns.net
    IN A
    Response
No results found
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    92.12.20.2.in-addr.arpa
    dns
    69 B
    131 B
    1
    1

    DNS Request

    92.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    124 B
    122 B
    2
    1

    DNS Request

    yerda22.ddns.net

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    74.209.201.84.in-addr.arpa
    dns
    72 B
    132 B
    1
    1

    DNS Request

    74.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    124 B
    122 B
    2
    1

    DNS Request

    yerda22.ddns.net

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    98.209.201.84.in-addr.arpa
    dns
    72 B
    132 B
    1
    1

    DNS Request

    98.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

  • 8.8.8.8:53
    yerda22.ddns.net
    dns
    server.exe
    62 B
    122 B
    1
    1

    DNS Request

    yerda22.ddns.net

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\server.exe

    Filesize

    100KB

    MD5

    4d777e7464920e953ff9ccc1e21ac320

    SHA1

    14effc2633d29c55c0ff8ef09359eca07c29a49f

    SHA256

    606f3743352d22f589b94dfa845d2ec06fe6f655791b47e415ff8f234926c8e2

    SHA512

    2916d173f01bebdc5df5a0447e8a5a6cf7c0680bfda37e61d7ce2cfe834554143eee04930057b48e7e9ea511fdd41af5be16c93ffacbbef9101d745398ac1a30

  • memory/976-17-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/976-1-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/976-2-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/976-3-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/976-16-0x0000000074BC2000-0x0000000074BC3000-memory.dmp

    Filesize

    4KB

  • memory/976-0-0x0000000074BC2000-0x0000000074BC3000-memory.dmp

    Filesize

    4KB

  • memory/2872-18-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/2872-19-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/2872-20-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/2872-21-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/2872-22-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/2872-23-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/2872-24-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

  • memory/2872-25-0x0000000074BC0000-0x0000000075171000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.