Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 17:02
General
-
Target
2e070cea455fa1e5c7c0e85c1cd07b9abc3114a3335efbeedc755088f584a5de.exe
-
Size
117KB
-
MD5
4072d20b7d87e7535996498f65c111fc
-
SHA1
cec2f3d04fdeceb0ef5f1d40e60fe9f659047ce1
-
SHA256
2e070cea455fa1e5c7c0e85c1cd07b9abc3114a3335efbeedc755088f584a5de
-
SHA512
7f591b4d930530a9058995cc70323ed3d86f595bd4ae9fc097662b79fabb69abacb2bb41c9fc7d3060ffe52bff1e38ce166be3d6d0bdf1ac70593fa2587e34d4
-
SSDEEP
1536:Tl+qMz7zRwM73ifqkWThNgktlw9C2hBjsVbR1YLOl+qMz7zRwM7T:Tb8iYHkyNgzC2vLOb8iYT
Malware Config
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e070cea455fa1e5c7c0e85c1cd07b9abc3114a3335efbeedc755088f584a5de.exe"C:\Users\Admin\AppData\Local\Temp\2e070cea455fa1e5c7c0e85c1cd07b9abc3114a3335efbeedc755088f584a5de.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dll.exe"C:\Users\Admin\AppData\Local\Temp\dll.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\javaupdate.exe"C:\Users\Admin\AppData\Roaming\javaupdate.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\javaupdate.exe" "javaupdate.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD551a2cf9f7d9d16fd126851230b9fd65f
SHA11b28295dfb2826af4e1ef8bacdb5c6a9c41b3da4
SHA2567022fe4aeff865cb8ebbef92a53666af65b6235eaa78764a7b582b1237025092
SHA512627888416fa15fdcb32deab921972bb34d8680ee1de47fb10755e30a46df8bce72bc2e9cbb159ff790606ae8212c78dec09c09384778579e0b14a5092f9efd07
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
136KB