Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-12-2020 05:50
Static task
static1
Behavioral task
behavioral1
Sample
qkZKfZTC9ZEN8z2.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
qkZKfZTC9ZEN8z2.exe
Resource
win10v20201028
General
-
Target
qkZKfZTC9ZEN8z2.exe
-
Size
383KB
-
MD5
170f90d6d9b128a8af103c8003539a54
-
SHA1
35a2f8791679b7b17fbb2758a4de717bf1314039
-
SHA256
b34672c7194dc439e09164ea39449d529a1efde6029f18edadb26e399591c68f
-
SHA512
512a34561fe2528287308738999ec9d58c1690098673af9cde7b429b7e307c21a9dd4c9e642514c7f51cf2971bafc975354f8d147b954292b1a4f12becdbac98
Malware Config
Extracted
njrat
0.7d
$$$$$$Fucking
whmfix009.cf:5409
f6a7c83d337d940f548e06019597f0a2
-
reg_key
f6a7c83d337d940f548e06019597f0a2
-
splitter
|'|'|
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
cAQzTs.execAQzTs.exepid process 2032 cAQzTs.exe 872 cAQzTs.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
qkZKfZTC9ZEN8z2.execAQzTs.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion qkZKfZTC9ZEN8z2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cAQzTs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cAQzTs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion qkZKfZTC9ZEN8z2.exe -
Drops startup file 2 IoCs
Processes:
cAQzTs.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f6a7c83d337d940f548e06019597f0a2.exe cAQzTs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f6a7c83d337d940f548e06019597f0a2.exe cAQzTs.exe -
Loads dropped DLL 1 IoCs
Processes:
qkZKfZTC9ZEN8z2.exepid process 1940 qkZKfZTC9ZEN8z2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cAQzTs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\f6a7c83d337d940f548e06019597f0a2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\cAQzTs.exe\" .." cAQzTs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f6a7c83d337d940f548e06019597f0a2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\cAQzTs.exe\" .." cAQzTs.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
qkZKfZTC9ZEN8z2.execAQzTs.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum qkZKfZTC9ZEN8z2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 qkZKfZTC9ZEN8z2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum cAQzTs.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 cAQzTs.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
qkZKfZTC9ZEN8z2.execAQzTs.exedescription pid process target process PID 848 set thread context of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 2032 set thread context of 872 2032 cAQzTs.exe cAQzTs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1616 schtasks.exe 1892 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
qkZKfZTC9ZEN8z2.execAQzTs.exepid process 848 qkZKfZTC9ZEN8z2.exe 2032 cAQzTs.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
qkZKfZTC9ZEN8z2.execAQzTs.execAQzTs.exedescription pid process Token: SeDebugPrivilege 848 qkZKfZTC9ZEN8z2.exe Token: SeDebugPrivilege 2032 cAQzTs.exe Token: SeDebugPrivilege 872 cAQzTs.exe Token: 33 872 cAQzTs.exe Token: SeIncBasePriorityPrivilege 872 cAQzTs.exe Token: 33 872 cAQzTs.exe Token: SeIncBasePriorityPrivilege 872 cAQzTs.exe Token: 33 872 cAQzTs.exe Token: SeIncBasePriorityPrivilege 872 cAQzTs.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
qkZKfZTC9ZEN8z2.exeqkZKfZTC9ZEN8z2.execAQzTs.execAQzTs.exedescription pid process target process PID 848 wrote to memory of 1616 848 qkZKfZTC9ZEN8z2.exe schtasks.exe PID 848 wrote to memory of 1616 848 qkZKfZTC9ZEN8z2.exe schtasks.exe PID 848 wrote to memory of 1616 848 qkZKfZTC9ZEN8z2.exe schtasks.exe PID 848 wrote to memory of 1616 848 qkZKfZTC9ZEN8z2.exe schtasks.exe PID 848 wrote to memory of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 848 wrote to memory of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 848 wrote to memory of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 848 wrote to memory of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 848 wrote to memory of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 848 wrote to memory of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 848 wrote to memory of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 848 wrote to memory of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 848 wrote to memory of 1940 848 qkZKfZTC9ZEN8z2.exe qkZKfZTC9ZEN8z2.exe PID 1940 wrote to memory of 2032 1940 qkZKfZTC9ZEN8z2.exe cAQzTs.exe PID 1940 wrote to memory of 2032 1940 qkZKfZTC9ZEN8z2.exe cAQzTs.exe PID 1940 wrote to memory of 2032 1940 qkZKfZTC9ZEN8z2.exe cAQzTs.exe PID 1940 wrote to memory of 2032 1940 qkZKfZTC9ZEN8z2.exe cAQzTs.exe PID 2032 wrote to memory of 1892 2032 cAQzTs.exe schtasks.exe PID 2032 wrote to memory of 1892 2032 cAQzTs.exe schtasks.exe PID 2032 wrote to memory of 1892 2032 cAQzTs.exe schtasks.exe PID 2032 wrote to memory of 1892 2032 cAQzTs.exe schtasks.exe PID 2032 wrote to memory of 872 2032 cAQzTs.exe cAQzTs.exe PID 2032 wrote to memory of 872 2032 cAQzTs.exe cAQzTs.exe PID 2032 wrote to memory of 872 2032 cAQzTs.exe cAQzTs.exe PID 2032 wrote to memory of 872 2032 cAQzTs.exe cAQzTs.exe PID 2032 wrote to memory of 872 2032 cAQzTs.exe cAQzTs.exe PID 2032 wrote to memory of 872 2032 cAQzTs.exe cAQzTs.exe PID 2032 wrote to memory of 872 2032 cAQzTs.exe cAQzTs.exe PID 2032 wrote to memory of 872 2032 cAQzTs.exe cAQzTs.exe PID 2032 wrote to memory of 872 2032 cAQzTs.exe cAQzTs.exe PID 872 wrote to memory of 1976 872 cAQzTs.exe netsh.exe PID 872 wrote to memory of 1976 872 cAQzTs.exe netsh.exe PID 872 wrote to memory of 1976 872 cAQzTs.exe netsh.exe PID 872 wrote to memory of 1976 872 cAQzTs.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qkZKfZTC9ZEN8z2.exe"C:\Users\Admin\AppData\Local\Temp\qkZKfZTC9ZEN8z2.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bEXOsg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEDF7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\qkZKfZTC9ZEN8z2.exe"{path}"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cAQzTs.exe"C:\Users\Admin\AppData\Roaming\cAQzTs.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bEXOsg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6BF.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\cAQzTs.exe"{path}"4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\cAQzTs.exe" "cAQzTs.exe" ENABLE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD6BF.tmpMD5
43cf72f31d2f3ee2c8e36207f821a4fb
SHA16acb1158e884daab04b8524094721addb90f08f9
SHA256c3d4cac26e6531bfe5db478ce3ba9eaa09ad9dfe180405a9fc6d114efd14b809
SHA5125b46a70739fdb50dd0da2a69f0c85127d61d5134f90d49f6c1844f61937da263377cf085d5167ecb773e0d3bbb63e3a6e98815a4f9e3c58d0b44ce2644155279
-
C:\Users\Admin\AppData\Local\Temp\tmpEDF7.tmpMD5
43cf72f31d2f3ee2c8e36207f821a4fb
SHA16acb1158e884daab04b8524094721addb90f08f9
SHA256c3d4cac26e6531bfe5db478ce3ba9eaa09ad9dfe180405a9fc6d114efd14b809
SHA5125b46a70739fdb50dd0da2a69f0c85127d61d5134f90d49f6c1844f61937da263377cf085d5167ecb773e0d3bbb63e3a6e98815a4f9e3c58d0b44ce2644155279
-
C:\Users\Admin\AppData\Roaming\cAQzTs.exeMD5
170f90d6d9b128a8af103c8003539a54
SHA135a2f8791679b7b17fbb2758a4de717bf1314039
SHA256b34672c7194dc439e09164ea39449d529a1efde6029f18edadb26e399591c68f
SHA512512a34561fe2528287308738999ec9d58c1690098673af9cde7b429b7e307c21a9dd4c9e642514c7f51cf2971bafc975354f8d147b954292b1a4f12becdbac98
-
C:\Users\Admin\AppData\Roaming\cAQzTs.exeMD5
170f90d6d9b128a8af103c8003539a54
SHA135a2f8791679b7b17fbb2758a4de717bf1314039
SHA256b34672c7194dc439e09164ea39449d529a1efde6029f18edadb26e399591c68f
SHA512512a34561fe2528287308738999ec9d58c1690098673af9cde7b429b7e307c21a9dd4c9e642514c7f51cf2971bafc975354f8d147b954292b1a4f12becdbac98
-
C:\Users\Admin\AppData\Roaming\cAQzTs.exeMD5
170f90d6d9b128a8af103c8003539a54
SHA135a2f8791679b7b17fbb2758a4de717bf1314039
SHA256b34672c7194dc439e09164ea39449d529a1efde6029f18edadb26e399591c68f
SHA512512a34561fe2528287308738999ec9d58c1690098673af9cde7b429b7e307c21a9dd4c9e642514c7f51cf2971bafc975354f8d147b954292b1a4f12becdbac98
-
\Users\Admin\AppData\Roaming\cAQzTs.exeMD5
170f90d6d9b128a8af103c8003539a54
SHA135a2f8791679b7b17fbb2758a4de717bf1314039
SHA256b34672c7194dc439e09164ea39449d529a1efde6029f18edadb26e399591c68f
SHA512512a34561fe2528287308738999ec9d58c1690098673af9cde7b429b7e307c21a9dd4c9e642514c7f51cf2971bafc975354f8d147b954292b1a4f12becdbac98
-
memory/848-6-0x0000000001030000-0x0000000001075000-memory.dmpFilesize
276KB
-
memory/848-2-0x00000000748D0000-0x0000000074FBE000-memory.dmpFilesize
6.9MB
-
memory/848-5-0x00000000002A0000-0x00000000002AE000-memory.dmpFilesize
56KB
-
memory/848-3-0x0000000001150000-0x0000000001151000-memory.dmpFilesize
4KB
-
memory/872-32-0x0000000074850000-0x0000000074F3E000-memory.dmpFilesize
6.9MB
-
memory/872-28-0x000000000040748E-mapping.dmp
-
memory/1616-7-0x0000000000000000-mapping.dmp
-
memory/1892-25-0x0000000000000000-mapping.dmp
-
memory/1940-13-0x00000000748D0000-0x0000000074FBE000-memory.dmpFilesize
6.9MB
-
memory/1940-11-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1940-12-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1940-10-0x000000000040748E-mapping.dmp
-
memory/1940-9-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1976-35-0x0000000000000000-mapping.dmp
-
memory/2032-20-0x00000000748D0000-0x0000000074FBE000-memory.dmpFilesize
6.9MB
-
memory/2032-21-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/2032-17-0x0000000000000000-mapping.dmp