Analysis
-
max time kernel
151s -
max time network
189s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-08-2021 12:39
Static task
static1
Behavioral task
behavioral1
Sample
37A8EE92838E77CF667250CEDD0CECF8.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
37A8EE92838E77CF667250CEDD0CECF8.exe
Resource
win10v20210410
General
-
Target
37A8EE92838E77CF667250CEDD0CECF8.exe
-
Size
501KB
-
MD5
37a8ee92838e77cf667250cedd0cecf8
-
SHA1
1c63553822af742ee07fb27865c51b54b74f1a27
-
SHA256
a1912487964fbfa6a9004a0889bde004a7b3d007e98706b79688bbb6229af557
-
SHA512
d943bcfccfa3710a6c311dfb4f13325a1fb39f77392897928e196b07d4c2209aa44e959d9b265530a7c0adfdf87db9950997d729b9811c541c2ff531f69e115c
Malware Config
Extracted
njrat
0.7d
HacKed
imfares.ddns.net:9090
doza122.con-ip.com:5552
21010c58298d9aa69d2fa375e98ef354
-
reg_key
21010c58298d9aa69d2fa375e98ef354
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
Server.exess.exewindowsdefender.exemidia.exepid process 1968 Server.exe 1696 ss.exe 576 windowsdefender.exe 936 midia.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
midia.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\84398377c5556d3df54a82be74cfa960.exe midia.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\84398377c5556d3df54a82be74cfa960.exe midia.exe -
Loads dropped DLL 1 IoCs
Processes:
Server.exepid process 1968 Server.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ss.exemidia.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\21010c58298d9aa69d2fa375e98ef354 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ss.exe\" .." ss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\21010c58298d9aa69d2fa375e98ef354 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ss.exe\" .." ss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\84398377c5556d3df54a82be74cfa960 = "\"C:\\Users\\Admin\\AppData\\Roaming\\midia.exe\" .." midia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\84398377c5556d3df54a82be74cfa960 = "\"C:\\Users\\Admin\\AppData\\Roaming\\midia.exe\" .." midia.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 60 IoCs
Processes:
ss.exemidia.exedescription pid process Token: SeDebugPrivilege 1696 ss.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: SeDebugPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe Token: 33 1696 ss.exe Token: SeIncBasePriorityPrivilege 1696 ss.exe Token: 33 936 midia.exe Token: SeIncBasePriorityPrivilege 936 midia.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
37A8EE92838E77CF667250CEDD0CECF8.exeServer.exess.exewindowsdefender.exemidia.exedescription pid process target process PID 1668 wrote to memory of 1968 1668 37A8EE92838E77CF667250CEDD0CECF8.exe Server.exe PID 1668 wrote to memory of 1968 1668 37A8EE92838E77CF667250CEDD0CECF8.exe Server.exe PID 1668 wrote to memory of 1968 1668 37A8EE92838E77CF667250CEDD0CECF8.exe Server.exe PID 1668 wrote to memory of 1968 1668 37A8EE92838E77CF667250CEDD0CECF8.exe Server.exe PID 1968 wrote to memory of 1696 1968 Server.exe ss.exe PID 1968 wrote to memory of 1696 1968 Server.exe ss.exe PID 1968 wrote to memory of 1696 1968 Server.exe ss.exe PID 1968 wrote to memory of 1696 1968 Server.exe ss.exe PID 1668 wrote to memory of 576 1668 37A8EE92838E77CF667250CEDD0CECF8.exe windowsdefender.exe PID 1668 wrote to memory of 576 1668 37A8EE92838E77CF667250CEDD0CECF8.exe windowsdefender.exe PID 1668 wrote to memory of 576 1668 37A8EE92838E77CF667250CEDD0CECF8.exe windowsdefender.exe PID 1696 wrote to memory of 528 1696 ss.exe netsh.exe PID 1696 wrote to memory of 528 1696 ss.exe netsh.exe PID 1696 wrote to memory of 528 1696 ss.exe netsh.exe PID 1696 wrote to memory of 528 1696 ss.exe netsh.exe PID 576 wrote to memory of 936 576 windowsdefender.exe midia.exe PID 576 wrote to memory of 936 576 windowsdefender.exe midia.exe PID 576 wrote to memory of 936 576 windowsdefender.exe midia.exe PID 936 wrote to memory of 904 936 midia.exe netsh.exe PID 936 wrote to memory of 904 936 midia.exe netsh.exe PID 936 wrote to memory of 904 936 midia.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37A8EE92838E77CF667250CEDD0CECF8.exe"C:\Users\Admin\AppData\Local\Temp\37A8EE92838E77CF667250CEDD0CECF8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ss.exe"C:\Users\Admin\AppData\Local\Temp\ss.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\ss.exe" "ss.exe" ENABLE4⤵
-
C:\Users\Admin\AppData\Local\Temp\windowsdefender.exe"C:\Users\Admin\AppData\Local\Temp\windowsdefender.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\midia.exe"C:\Users\Admin\AppData\Roaming\midia.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\midia.exe" "midia.exe" ENABLE4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Server.exeMD5
cdbb79508d72203c58609d91d047e301
SHA17393e8ff013e34d5f6dd25f826a65a93e35c4187
SHA25657ccaf6d672e35215ba32b6591bc0a28bfeade9b5bf8b70afa5b9d2ba7346e3f
SHA51292a126b7b128ecc30256ac0e4482b5d74b5182371874271f032c9cf61d526f26830999310ee0970ed735660f50cba73b4ba9847a140f0f329cf5fd8fe26a994e
-
C:\Users\Admin\AppData\Local\Temp\Server.exeMD5
cdbb79508d72203c58609d91d047e301
SHA17393e8ff013e34d5f6dd25f826a65a93e35c4187
SHA25657ccaf6d672e35215ba32b6591bc0a28bfeade9b5bf8b70afa5b9d2ba7346e3f
SHA51292a126b7b128ecc30256ac0e4482b5d74b5182371874271f032c9cf61d526f26830999310ee0970ed735660f50cba73b4ba9847a140f0f329cf5fd8fe26a994e
-
C:\Users\Admin\AppData\Local\Temp\ss.exeMD5
cdbb79508d72203c58609d91d047e301
SHA17393e8ff013e34d5f6dd25f826a65a93e35c4187
SHA25657ccaf6d672e35215ba32b6591bc0a28bfeade9b5bf8b70afa5b9d2ba7346e3f
SHA51292a126b7b128ecc30256ac0e4482b5d74b5182371874271f032c9cf61d526f26830999310ee0970ed735660f50cba73b4ba9847a140f0f329cf5fd8fe26a994e
-
C:\Users\Admin\AppData\Local\Temp\ss.exeMD5
cdbb79508d72203c58609d91d047e301
SHA17393e8ff013e34d5f6dd25f826a65a93e35c4187
SHA25657ccaf6d672e35215ba32b6591bc0a28bfeade9b5bf8b70afa5b9d2ba7346e3f
SHA51292a126b7b128ecc30256ac0e4482b5d74b5182371874271f032c9cf61d526f26830999310ee0970ed735660f50cba73b4ba9847a140f0f329cf5fd8fe26a994e
-
C:\Users\Admin\AppData\Local\Temp\windowsdefender.exeMD5
af290b8ff78113678bd4828d9e446ad6
SHA168581f15f701792ef96e95bbfce8b072648b9a70
SHA2567cbea2906a3099a25b10fd3019a29a5b0f811181e99615dac59c807ff38f6a7a
SHA5129d895d28271bf392b0294eff8af6415a9d31683c848515ea1079f5612ea807ade6e22e58fe7bc3636a3238c68e2e0aaae49505629cecc02d7eb14eaddd456f05
-
C:\Users\Admin\AppData\Local\Temp\windowsdefender.exeMD5
af290b8ff78113678bd4828d9e446ad6
SHA168581f15f701792ef96e95bbfce8b072648b9a70
SHA2567cbea2906a3099a25b10fd3019a29a5b0f811181e99615dac59c807ff38f6a7a
SHA5129d895d28271bf392b0294eff8af6415a9d31683c848515ea1079f5612ea807ade6e22e58fe7bc3636a3238c68e2e0aaae49505629cecc02d7eb14eaddd456f05
-
C:\Users\Admin\AppData\Roaming\midia.exeMD5
af290b8ff78113678bd4828d9e446ad6
SHA168581f15f701792ef96e95bbfce8b072648b9a70
SHA2567cbea2906a3099a25b10fd3019a29a5b0f811181e99615dac59c807ff38f6a7a
SHA5129d895d28271bf392b0294eff8af6415a9d31683c848515ea1079f5612ea807ade6e22e58fe7bc3636a3238c68e2e0aaae49505629cecc02d7eb14eaddd456f05
-
C:\Users\Admin\AppData\Roaming\midia.exeMD5
af290b8ff78113678bd4828d9e446ad6
SHA168581f15f701792ef96e95bbfce8b072648b9a70
SHA2567cbea2906a3099a25b10fd3019a29a5b0f811181e99615dac59c807ff38f6a7a
SHA5129d895d28271bf392b0294eff8af6415a9d31683c848515ea1079f5612ea807ade6e22e58fe7bc3636a3238c68e2e0aaae49505629cecc02d7eb14eaddd456f05
-
\Users\Admin\AppData\Local\Temp\ss.exeMD5
cdbb79508d72203c58609d91d047e301
SHA17393e8ff013e34d5f6dd25f826a65a93e35c4187
SHA25657ccaf6d672e35215ba32b6591bc0a28bfeade9b5bf8b70afa5b9d2ba7346e3f
SHA51292a126b7b128ecc30256ac0e4482b5d74b5182371874271f032c9cf61d526f26830999310ee0970ed735660f50cba73b4ba9847a140f0f329cf5fd8fe26a994e
-
memory/528-79-0x0000000000000000-mapping.dmp
-
memory/576-78-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/576-72-0x0000000000000000-mapping.dmp
-
memory/576-75-0x0000000001290000-0x0000000001291000-memory.dmpFilesize
4KB
-
memory/576-77-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/904-89-0x000007FEFC221000-0x000007FEFC223000-memory.dmpFilesize
8KB
-
memory/904-88-0x0000000000000000-mapping.dmp
-
memory/936-84-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/936-81-0x0000000000000000-mapping.dmp
-
memory/936-87-0x0000000000460000-0x0000000000462000-memory.dmpFilesize
8KB
-
memory/1668-64-0x0000000000960000-0x0000000000962000-memory.dmpFilesize
8KB
-
memory/1696-67-0x0000000000000000-mapping.dmp
-
memory/1696-71-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/1968-63-0x00000000768B1000-0x00000000768B3000-memory.dmpFilesize
8KB
-
memory/1968-60-0x0000000000000000-mapping.dmp
-
memory/1968-65-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB