Analysis
- max time kernel
149s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
14/12/2020, 19:05
Static task
static1
Behavioral task
behavioral1
Sample
9115ca488f308a6f1f9ebf19a164b9e1.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9115ca488f308a6f1f9ebf19a164b9e1.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 9115ca488f308a6f1f9ebf19a164b9e1.exe
- Size 23KB
- Sample201214-cte1atygh6
- SHA256 4ddb173a67ca5a5ccce340d40afcbfae4bc7d929ab41c07a6972269c6c71348b
- MD5 9115ca488f308a6f1f9ebf19a164b9e1
- SHA1 8f64760441290cd44d5dcfa2286cc82d26cba699
- SHA512 ba9de94f3cad734db4b51592f8a03417f39662bc24dea879f462923f610f462254bd4c96ebc89573f4a36f8b20a436aa521919e4cbc72418d8c8f02073d000b5
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
Alternative Flash Playe
C2
-
552020.ddns.net:5552
Mutex
-
0ce50ee3b687c9aef6488d6ebf87a549
Attributes
-
reg_key
0ce50ee3b687c9aef6488d6ebf87a549
-
splitter
|'|'|
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4072 Alternative Flash Playe.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ce50ee3b687c9aef6488d6ebf87a549.exe Alternative Flash Playe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ce50ee3b687c9aef6488d6ebf87a549.exe Alternative Flash Playe.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\0ce50ee3b687c9aef6488d6ebf87a549 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Alternative Flash Playe.exe\" .." Alternative Flash Playe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0ce50ee3b687c9aef6488d6ebf87a549 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Alternative Flash Playe.exe\" .." Alternative Flash Playe.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe Token: 33 4072 Alternative Flash Playe.exe Token: SeIncBasePriorityPrivilege 4072 Alternative Flash Playe.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2604 wrote to memory of 4072 2604 9115ca488f308a6f1f9ebf19a164b9e1.exe 77 PID 2604 wrote to memory of 4072 2604 9115ca488f308a6f1f9ebf19a164b9e1.exe 77 PID 2604 wrote to memory of 4072 2604 9115ca488f308a6f1f9ebf19a164b9e1.exe 77 PID 4072 wrote to memory of 1012 4072 Alternative Flash Playe.exe 79 PID 4072 wrote to memory of 1012 4072 Alternative Flash Playe.exe 79 PID 4072 wrote to memory of 1012 4072 Alternative Flash Playe.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\9115ca488f308a6f1f9ebf19a164b9e1.exe"C:\Users\Admin\AppData\Local\Temp\9115ca488f308a6f1f9ebf19a164b9e1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\Alternative Flash Playe.exe"C:\Users\Admin\AppData\Local\Temp\Alternative Flash Playe.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Alternative Flash Playe.exe" "Alternative Flash Playe.exe" ENABLE3⤵PID:1012
-
-