Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
05-02-2025 23:00
General
-
Target
43f8d95b14a04307b1a1455981ade506.exe
-
Size
23KB
-
MD5
43f8d95b14a04307b1a1455981ade506
-
SHA1
57572c8132a8452c2c8f7af546859ffcc7795ed8
-
SHA256
45a70728e0d5c32ab6b1c3b4ddd0a6b1ec2e62c9cb3cc3f8ef1f4eabb6ace928
-
SHA512
ced4ed557c7b22c1c273992eaf33182efcb15df6e5bf4cc7a0582d12c70ebfc100abe90224ab10702d247eca0d56ce4a2818c918210b35d8c4820e1f7415d6f6
-
SSDEEP
384:GV+n2650N3qZbATcjRGC5EowD46BgnqUhay1ZmRvR6JZlbw8hqIusZzZudN:Gam+71d5cRpcnuHz
Score
10/10
Malware Config
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43f8d95b14a04307b1a1455981ade506.exe"C:\Users\Admin\AppData\Local\Temp\43f8d95b14a04307b1a1455981ade506.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\43f8d95b14a04307b1a1455981ade506.exe" "43f8d95b14a04307b1a1455981ade506.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB