Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    16-06-2021 07:12

General

  • Target

    0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe

  • Size

    2.8MB

  • MD5

    1aed5d95ffc86126b79a9fe69f3f8af4

  • SHA1

    de35454b27c455326a5b4974830d32f70058a839

  • SHA256

    0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0

  • SHA512

    33274d75ae2b56cd403fddf5007a2df2d29f0dd93e043b43bcd292ca370c0b05544dc1c8033279c769fa48fcc8631261cfc5da6f3bc9250dc6b1eea7ddfc2522

Malware Config

Extracted

Family

njrat

Version

Carbonblack2102

Botnet

batvoi

C2

1368.vnh.wtf:5552

Mutex

0de45b5c6627a3e65a4b2a1e68ec841b

Attributes
  • reg_key

    0de45b5c6627a3e65a4b2a1e68ec841b

  • splitter

    |'|'|

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 3 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 4 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe
    "C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Users\Admin\AppData\Local\Temp\MRGO.EXE
      "C:\Users\Admin\AppData\Local\Temp\MRGO.EXE"
      2⤵
      • Executes dropped EXE
      • Checks BIOS information in registry
      PID:3676
    • C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE
      "C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3600
      • C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe
        "C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe" "WMI Performance Reverse Adapters.exe" ENABLE
          4⤵
            PID:3280
      • C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE
        "C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2468
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
          3⤵
            PID:1820

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\MRGO.EXE

        MD5

        9a6a87cffd1c2f6c4f7f86ccc23b8c79

        SHA1

        7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2

        SHA256

        3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39

        SHA512

        a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

      • C:\Users\Admin\AppData\Local\Temp\MRGO.EXE

        MD5

        9a6a87cffd1c2f6c4f7f86ccc23b8c79

        SHA1

        7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2

        SHA256

        3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39

        SHA512

        a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

      • C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE

        MD5

        870a6f849d1e8f3297d3d947de1d3dda

        SHA1

        2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97

        SHA256

        b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b

        SHA512

        f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

      • C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE

        MD5

        870a6f849d1e8f3297d3d947de1d3dda

        SHA1

        2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97

        SHA256

        b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b

        SHA512

        f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

      • C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE

        MD5

        5375abc86290f5c3ffa86d4129e4bd27

        SHA1

        a1a3b2165549bd4c34985d3a230f8304202926ab

        SHA256

        c499e93433a8ff462799108ac5462ce05fa93bf716f3723fbccb7ff13dbebb9f

        SHA512

        f951acf23e5576fae983fd805a32eebea95966c74ffffd99bbd6de17d2e5db0db9b282c242d00e5515b4d67d885f09c749fae09aece26275f17f0d20670b6709

      • C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE

        MD5

        5375abc86290f5c3ffa86d4129e4bd27

        SHA1

        a1a3b2165549bd4c34985d3a230f8304202926ab

        SHA256

        c499e93433a8ff462799108ac5462ce05fa93bf716f3723fbccb7ff13dbebb9f

        SHA512

        f951acf23e5576fae983fd805a32eebea95966c74ffffd99bbd6de17d2e5db0db9b282c242d00e5515b4d67d885f09c749fae09aece26275f17f0d20670b6709

      • C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe

        MD5

        870a6f849d1e8f3297d3d947de1d3dda

        SHA1

        2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97

        SHA256

        b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b

        SHA512

        f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

      • C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe

        MD5

        870a6f849d1e8f3297d3d947de1d3dda

        SHA1

        2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97

        SHA256

        b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b

        SHA512

        f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

      • memory/1820-151-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

      • memory/1820-150-0x000000000041CEE8-mapping.dmp

      • memory/1820-149-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

      • memory/2208-144-0x0000000005420000-0x00000000054BC000-memory.dmp

        Filesize

        624KB

      • memory/2208-135-0x0000000000000000-mapping.dmp

      • memory/2208-146-0x0000000005880000-0x0000000005881000-memory.dmp

        Filesize

        4KB

      • memory/2208-145-0x0000000005630000-0x0000000005631000-memory.dmp

        Filesize

        4KB

      • memory/2468-147-0x00000000052E0000-0x00000000052E6000-memory.dmp

        Filesize

        24KB

      • memory/2468-132-0x0000000005020000-0x0000000005060000-memory.dmp

        Filesize

        256KB

      • memory/2468-133-0x0000000005070000-0x0000000005089000-memory.dmp

        Filesize

        100KB

      • memory/2468-118-0x0000000000000000-mapping.dmp

      • memory/2468-124-0x00000000007C0000-0x00000000007C1000-memory.dmp

        Filesize

        4KB

      • memory/2468-148-0x0000000005DF0000-0x0000000005DF1000-memory.dmp

        Filesize

        4KB

      • memory/2468-130-0x00000000050C0000-0x00000000050C1000-memory.dmp

        Filesize

        4KB

      • memory/2468-134-0x00000000050C0000-0x00000000055BE000-memory.dmp

        Filesize

        5.0MB

      • memory/3280-142-0x0000000000000000-mapping.dmp

      • memory/3600-128-0x0000000005750000-0x0000000005751000-memory.dmp

        Filesize

        4KB

      • memory/3600-123-0x0000000000920000-0x0000000000921000-memory.dmp

        Filesize

        4KB

      • memory/3600-127-0x0000000005160000-0x0000000005161000-memory.dmp

        Filesize

        4KB

      • memory/3600-116-0x0000000000000000-mapping.dmp

      • memory/3676-114-0x0000000000000000-mapping.dmp