Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 13:15
General
-
Target
f941d4289c21e6869ccc150d0ac16949.exe
-
Size
31KB
-
MD5
f941d4289c21e6869ccc150d0ac16949
-
SHA1
e83c6a286a32b1b92d03f93af7c7db1b98577f47
-
SHA256
87124ba55c45642f67890b15ffd1bc0e7911bdf8647af2b3eb0e52073353271f
-
SHA512
38da0fc14735c29e8fe395383b06155d658a48668f3f4a3f39e6e9ca5bbcac22a646d4d5e6d2572dacd5a5d05cf84478664954d30bc5dc55d371929e529cfe65
-
SSDEEP
768:1rhO5b13hdwzxLy3os0O/dMRvCnQmIDUu0tikFj:5cZ6eh6gQVkJj
Score
10/10
Malware Config
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f941d4289c21e6869ccc150d0ac16949.exe"C:\Users\Admin\AppData\Local\Temp\f941d4289c21e6869ccc150d0ac16949.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\f941d4289c21e6869ccc150d0ac16949.exe" "f941d4289c21e6869ccc150d0ac16949.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB