Analysis
- max time kernel
151s - max time network
135s - platform
windows7_x64 - resource
win7v20201028 - submitted
14/12/2020, 19:05
Static task
static1
Behavioral task
behavioral1
Sample
9115ca488f308a6f1f9ebf19a164b9e1.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9115ca488f308a6f1f9ebf19a164b9e1.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 9115ca488f308a6f1f9ebf19a164b9e1.exe
- Size 23KB
- Sample201214-cte1atygh6
- SHA256 4ddb173a67ca5a5ccce340d40afcbfae4bc7d929ab41c07a6972269c6c71348b
- MD5 9115ca488f308a6f1f9ebf19a164b9e1
- SHA1 8f64760441290cd44d5dcfa2286cc82d26cba699
- SHA512 ba9de94f3cad734db4b51592f8a03417f39662bc24dea879f462923f610f462254bd4c96ebc89573f4a36f8b20a436aa521919e4cbc72418d8c8f02073d000b5
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
Alternative Flash Playe
C2
-
552020.ddns.net:5552
Mutex
-
0ce50ee3b687c9aef6488d6ebf87a549
Attributes
-
reg_key
0ce50ee3b687c9aef6488d6ebf87a549
-
splitter
|'|'|
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1168 Alternative Flash Playe.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ce50ee3b687c9aef6488d6ebf87a549.exe Alternative Flash Playe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ce50ee3b687c9aef6488d6ebf87a549.exe Alternative Flash Playe.exe - Loads dropped DLL 1 IoCs
pid Process 932 9115ca488f308a6f1f9ebf19a164b9e1.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0ce50ee3b687c9aef6488d6ebf87a549 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Alternative Flash Playe.exe\" .." Alternative Flash Playe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\0ce50ee3b687c9aef6488d6ebf87a549 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Alternative Flash Playe.exe\" .." Alternative Flash Playe.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe Token: 33 1168 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 1168 Alternative Flash Playe.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 932 wrote to memory of 1168 932 9115ca488f308a6f1f9ebf19a164b9e1.exe 29 PID 932 wrote to memory of 1168 932 9115ca488f308a6f1f9ebf19a164b9e1.exe 29 PID 932 wrote to memory of 1168 932 9115ca488f308a6f1f9ebf19a164b9e1.exe 29 PID 932 wrote to memory of 1168 932 9115ca488f308a6f1f9ebf19a164b9e1.exe 29 PID 1168 wrote to memory of 1136 1168 Alternative Flash Playe.exe 30 PID 1168 wrote to memory of 1136 1168 Alternative Flash Playe.exe 30 PID 1168 wrote to memory of 1136 1168 Alternative Flash Playe.exe 30 PID 1168 wrote to memory of 1136 1168 Alternative Flash Playe.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\9115ca488f308a6f1f9ebf19a164b9e1.exe"C:\Users\Admin\AppData\Local\Temp\9115ca488f308a6f1f9ebf19a164b9e1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\Alternative Flash Playe.exe"C:\Users\Admin\AppData\Local\Temp\Alternative Flash Playe.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Alternative Flash Playe.exe" "Alternative Flash Playe.exe" ENABLE3⤵PID:1136
-
-