Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 07:07
Static task
static1
Behavioral task
behavioral1
Sample
691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd.exe
Resource
win10v20201028
General
-
Target
691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd.exe
-
Size
77KB
-
MD5
b4363c72117293e6255206899303107f
-
SHA1
1083c177d9bfd91ae7a66580a16ad895fb7d81ab
-
SHA256
691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd
-
SHA512
a3490667f895608a5b3c57d198f05e28c49480d2d0cf46e5930055a807a10180f13be627fbb3012ee219772dbb8b841d5f035a09323f08a8842dab1aa46d864f
Malware Config
Extracted
njrat
0.7d
PBBR
kinholima.duckdns.org:1177
a2677b62d1e55c91df28f4990150043c
-
reg_key
a2677b62d1e55c91df28f4990150043c
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
chrome.exepid process 212 chrome.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
chrome.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2677b62d1e55c91df28f4990150043c.exe chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2677b62d1e55c91df28f4990150043c.exe chrome.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chrome.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\a2677b62d1e55c91df28f4990150043c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a2677b62d1e55c91df28f4990150043c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
chrome.exedescription pid process Token: SeDebugPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe Token: 33 212 chrome.exe Token: SeIncBasePriorityPrivilege 212 chrome.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd.exechrome.exedescription pid process target process PID 508 wrote to memory of 212 508 691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd.exe chrome.exe PID 508 wrote to memory of 212 508 691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd.exe chrome.exe PID 508 wrote to memory of 212 508 691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd.exe chrome.exe PID 212 wrote to memory of 504 212 chrome.exe netsh.exe PID 212 wrote to memory of 504 212 chrome.exe netsh.exe PID 212 wrote to memory of 504 212 chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd.exe"C:\Users\Admin\AppData\Local\Temp\691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome.exe" "chrome.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeMD5
b4363c72117293e6255206899303107f
SHA11083c177d9bfd91ae7a66580a16ad895fb7d81ab
SHA256691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd
SHA512a3490667f895608a5b3c57d198f05e28c49480d2d0cf46e5930055a807a10180f13be627fbb3012ee219772dbb8b841d5f035a09323f08a8842dab1aa46d864f
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeMD5
b4363c72117293e6255206899303107f
SHA11083c177d9bfd91ae7a66580a16ad895fb7d81ab
SHA256691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd
SHA512a3490667f895608a5b3c57d198f05e28c49480d2d0cf46e5930055a807a10180f13be627fbb3012ee219772dbb8b841d5f035a09323f08a8842dab1aa46d864f
-
memory/212-12-0x0000000000000000-mapping.dmp
-
memory/212-26-0x0000000006D90000-0x0000000006D91000-memory.dmpFilesize
4KB
-
memory/212-24-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/212-15-0x0000000073360000-0x0000000073A4E000-memory.dmpFilesize
6.9MB
-
memory/504-25-0x0000000000000000-mapping.dmp
-
memory/508-7-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/508-11-0x0000000005C40000-0x0000000005C46000-memory.dmpFilesize
24KB
-
memory/508-10-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/508-9-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/508-8-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/508-2-0x0000000073360000-0x0000000073A4E000-memory.dmpFilesize
6.9MB
-
memory/508-6-0x0000000005CB0000-0x0000000005CB1000-memory.dmpFilesize
4KB
-
memory/508-5-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/508-3-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB