Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
02-01-2025 09:11
General
-
Target
c4a07f7612b822a1c6e6879ba5dcc5de.exe
-
Size
209KB
-
MD5
c4a07f7612b822a1c6e6879ba5dcc5de
-
SHA1
09d44c896d14e7df8d8da0d938235ee33c9b2281
-
SHA256
391d3357c3e07d6444f6cd189f68d748c52444c30d3dd68282c50acf62e5db72
-
SHA512
27c07202d83ac4593e1f734480f735e2b4d02bac4646211756eb852267aff8c1acbe974161c93ac6baf1981ad669b5a30f4d320bc26f4f1d1e71b2ed1dc90058
-
SSDEEP
3072:rR2EJHNNObrQy5y6GrEHBAnpK37nX9840BQ5f74tyJhcMKNFhHF+bs5iRXr:124NMbrQy7L8c0Fpgs5iJ
Malware Config
Extracted
njrat
0.7d
ByABOLHB
abolhb.com:505
165d6ed988ac
-
reg_key
165d6ed988ac
-
splitter
|'|'|
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4a07f7612b822a1c6e6879ba5dcc5de.exe"C:\Users\Admin\AppData\Local\Temp\c4a07f7612b822a1c6e6879ba5dcc5de.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {A28AEBFA-7082-4BC8-B56C-CF316FC3607E} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdateTaskMachineUAC.exeC:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdateTaskMachineUAC.exe2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5c4a07f7612b822a1c6e6879ba5dcc5de
SHA109d44c896d14e7df8d8da0d938235ee33c9b2281
SHA256391d3357c3e07d6444f6cd189f68d748c52444c30d3dd68282c50acf62e5db72
SHA51227c07202d83ac4593e1f734480f735e2b4d02bac4646211756eb852267aff8c1acbe974161c93ac6baf1981ad669b5a30f4d320bc26f4f1d1e71b2ed1dc90058
-
Filesize
232KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB