Analysis
-
max time kernel
76s -
max time network
204s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
11-12-2024 18:10
General
-
Target
Nordvpn Checker by xRisky/Nordvpn Checker by xRisky.exe
-
Size
1.2MB
-
MD5
4a8a6e0dee9058400bb2e55fabc14f75
-
SHA1
a7d28731d4f1829bfd1af9273ca9a61fa05f9ede
-
SHA256
86cc041b294b33d95ec7e78954b9a03fbbdd0d08f5eee39bc9ee3c6fab053694
-
SHA512
50b0d6dad029961732bb3eb660f393bd7edbeaf7393182ad654af7ceb81eed07e5beab64683293bbfe8cf90241035c2c80a825e4f963523a9c54231ee005ffb3
-
SSDEEP
24576:PCdxte/80jYLT3U1jfsWa0U3Ui9V1aI+vx31U3DQ9:Ow80cTsjkWa0GsIklp9
Malware Config
Extracted
njrat
0.7d
Checkers
pur3vpn.ddns.net:5559
cc903deaeeb6a6a7c2a29474210cea6f
-
reg_key
cc903deaeeb6a6a7c2a29474210cea6f
-
splitter
|'|'|
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nordvpn Checker by xRisky\Nordvpn Checker by xRisky.exe"C:\Users\Admin\AppData\Local\Temp\Nordvpn Checker by xRisky\Nordvpn Checker by xRisky.exe"1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn Micrsoft Windows /tr "C:\Users\Admin\AppData\Roaming\Windows update service \Microsoft update .exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB