Analysis
-
max time kernel
150s -
max time network
165s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-08-2021 12:39
Static task
static1
Behavioral task
behavioral1
Sample
37A8EE92838E77CF667250CEDD0CECF8.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
37A8EE92838E77CF667250CEDD0CECF8.exe
Resource
win10v20210410
General
-
Target
37A8EE92838E77CF667250CEDD0CECF8.exe
-
Size
501KB
-
MD5
37a8ee92838e77cf667250cedd0cecf8
-
SHA1
1c63553822af742ee07fb27865c51b54b74f1a27
-
SHA256
a1912487964fbfa6a9004a0889bde004a7b3d007e98706b79688bbb6229af557
-
SHA512
d943bcfccfa3710a6c311dfb4f13325a1fb39f77392897928e196b07d4c2209aa44e959d9b265530a7c0adfdf87db9950997d729b9811c541c2ff531f69e115c
Malware Config
Extracted
njrat
0.7d
HacKed
imfares.ddns.net:9090
doza122.con-ip.com:5552
21010c58298d9aa69d2fa375e98ef354
-
reg_key
21010c58298d9aa69d2fa375e98ef354
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
Server.exess.exewindowsdefender.exemidia.exepid process 2388 Server.exe 2008 ss.exe 3200 windowsdefender.exe 3960 midia.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
midia.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\84398377c5556d3df54a82be74cfa960.exe midia.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\84398377c5556d3df54a82be74cfa960.exe midia.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
ss.exemidia.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\21010c58298d9aa69d2fa375e98ef354 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ss.exe\" .." ss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\21010c58298d9aa69d2fa375e98ef354 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ss.exe\" .." ss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\84398377c5556d3df54a82be74cfa960 = "\"C:\\Users\\Admin\\AppData\\Roaming\\midia.exe\" .." midia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\84398377c5556d3df54a82be74cfa960 = "\"C:\\Users\\Admin\\AppData\\Roaming\\midia.exe\" .." midia.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ss.exemidia.exedescription pid process Token: SeDebugPrivilege 2008 ss.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: SeDebugPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe Token: 33 2008 ss.exe Token: SeIncBasePriorityPrivilege 2008 ss.exe Token: 33 3960 midia.exe Token: SeIncBasePriorityPrivilege 3960 midia.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
37A8EE92838E77CF667250CEDD0CECF8.exeServer.exess.exewindowsdefender.exemidia.exedescription pid process target process PID 3944 wrote to memory of 2388 3944 37A8EE92838E77CF667250CEDD0CECF8.exe Server.exe PID 3944 wrote to memory of 2388 3944 37A8EE92838E77CF667250CEDD0CECF8.exe Server.exe PID 3944 wrote to memory of 2388 3944 37A8EE92838E77CF667250CEDD0CECF8.exe Server.exe PID 2388 wrote to memory of 2008 2388 Server.exe ss.exe PID 2388 wrote to memory of 2008 2388 Server.exe ss.exe PID 2388 wrote to memory of 2008 2388 Server.exe ss.exe PID 3944 wrote to memory of 3200 3944 37A8EE92838E77CF667250CEDD0CECF8.exe windowsdefender.exe PID 3944 wrote to memory of 3200 3944 37A8EE92838E77CF667250CEDD0CECF8.exe windowsdefender.exe PID 2008 wrote to memory of 2136 2008 ss.exe netsh.exe PID 2008 wrote to memory of 2136 2008 ss.exe netsh.exe PID 2008 wrote to memory of 2136 2008 ss.exe netsh.exe PID 3200 wrote to memory of 3960 3200 windowsdefender.exe midia.exe PID 3200 wrote to memory of 3960 3200 windowsdefender.exe midia.exe PID 3960 wrote to memory of 1100 3960 midia.exe netsh.exe PID 3960 wrote to memory of 1100 3960 midia.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37A8EE92838E77CF667250CEDD0CECF8.exe"C:\Users\Admin\AppData\Local\Temp\37A8EE92838E77CF667250CEDD0CECF8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ss.exe"C:\Users\Admin\AppData\Local\Temp\ss.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\ss.exe" "ss.exe" ENABLE4⤵
-
C:\Users\Admin\AppData\Local\Temp\windowsdefender.exe"C:\Users\Admin\AppData\Local\Temp\windowsdefender.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\midia.exe"C:\Users\Admin\AppData\Roaming\midia.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\midia.exe" "midia.exe" ENABLE4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Server.exeMD5
cdbb79508d72203c58609d91d047e301
SHA17393e8ff013e34d5f6dd25f826a65a93e35c4187
SHA25657ccaf6d672e35215ba32b6591bc0a28bfeade9b5bf8b70afa5b9d2ba7346e3f
SHA51292a126b7b128ecc30256ac0e4482b5d74b5182371874271f032c9cf61d526f26830999310ee0970ed735660f50cba73b4ba9847a140f0f329cf5fd8fe26a994e
-
C:\Users\Admin\AppData\Local\Temp\Server.exeMD5
cdbb79508d72203c58609d91d047e301
SHA17393e8ff013e34d5f6dd25f826a65a93e35c4187
SHA25657ccaf6d672e35215ba32b6591bc0a28bfeade9b5bf8b70afa5b9d2ba7346e3f
SHA51292a126b7b128ecc30256ac0e4482b5d74b5182371874271f032c9cf61d526f26830999310ee0970ed735660f50cba73b4ba9847a140f0f329cf5fd8fe26a994e
-
C:\Users\Admin\AppData\Local\Temp\ss.exeMD5
cdbb79508d72203c58609d91d047e301
SHA17393e8ff013e34d5f6dd25f826a65a93e35c4187
SHA25657ccaf6d672e35215ba32b6591bc0a28bfeade9b5bf8b70afa5b9d2ba7346e3f
SHA51292a126b7b128ecc30256ac0e4482b5d74b5182371874271f032c9cf61d526f26830999310ee0970ed735660f50cba73b4ba9847a140f0f329cf5fd8fe26a994e
-
C:\Users\Admin\AppData\Local\Temp\ss.exeMD5
cdbb79508d72203c58609d91d047e301
SHA17393e8ff013e34d5f6dd25f826a65a93e35c4187
SHA25657ccaf6d672e35215ba32b6591bc0a28bfeade9b5bf8b70afa5b9d2ba7346e3f
SHA51292a126b7b128ecc30256ac0e4482b5d74b5182371874271f032c9cf61d526f26830999310ee0970ed735660f50cba73b4ba9847a140f0f329cf5fd8fe26a994e
-
C:\Users\Admin\AppData\Local\Temp\windowsdefender.exeMD5
af290b8ff78113678bd4828d9e446ad6
SHA168581f15f701792ef96e95bbfce8b072648b9a70
SHA2567cbea2906a3099a25b10fd3019a29a5b0f811181e99615dac59c807ff38f6a7a
SHA5129d895d28271bf392b0294eff8af6415a9d31683c848515ea1079f5612ea807ade6e22e58fe7bc3636a3238c68e2e0aaae49505629cecc02d7eb14eaddd456f05
-
C:\Users\Admin\AppData\Local\Temp\windowsdefender.exeMD5
af290b8ff78113678bd4828d9e446ad6
SHA168581f15f701792ef96e95bbfce8b072648b9a70
SHA2567cbea2906a3099a25b10fd3019a29a5b0f811181e99615dac59c807ff38f6a7a
SHA5129d895d28271bf392b0294eff8af6415a9d31683c848515ea1079f5612ea807ade6e22e58fe7bc3636a3238c68e2e0aaae49505629cecc02d7eb14eaddd456f05
-
C:\Users\Admin\AppData\Roaming\midia.exeMD5
af290b8ff78113678bd4828d9e446ad6
SHA168581f15f701792ef96e95bbfce8b072648b9a70
SHA2567cbea2906a3099a25b10fd3019a29a5b0f811181e99615dac59c807ff38f6a7a
SHA5129d895d28271bf392b0294eff8af6415a9d31683c848515ea1079f5612ea807ade6e22e58fe7bc3636a3238c68e2e0aaae49505629cecc02d7eb14eaddd456f05
-
C:\Users\Admin\AppData\Roaming\midia.exeMD5
af290b8ff78113678bd4828d9e446ad6
SHA168581f15f701792ef96e95bbfce8b072648b9a70
SHA2567cbea2906a3099a25b10fd3019a29a5b0f811181e99615dac59c807ff38f6a7a
SHA5129d895d28271bf392b0294eff8af6415a9d31683c848515ea1079f5612ea807ade6e22e58fe7bc3636a3238c68e2e0aaae49505629cecc02d7eb14eaddd456f05
-
memory/1100-138-0x0000000000000000-mapping.dmp
-
memory/2008-119-0x0000000000000000-mapping.dmp
-
memory/2008-122-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/2136-130-0x0000000000000000-mapping.dmp
-
memory/2388-114-0x0000000000000000-mapping.dmp
-
memory/2388-118-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/3200-126-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/3200-128-0x0000000001150000-0x0000000001156000-memory.dmpFilesize
24KB
-
memory/3200-129-0x000000001CDF0000-0x000000001CDF2000-memory.dmpFilesize
8KB
-
memory/3200-123-0x0000000000000000-mapping.dmp
-
memory/3944-117-0x0000000002DB0000-0x0000000002DB2000-memory.dmpFilesize
8KB
-
memory/3960-131-0x0000000000000000-mapping.dmp
-
memory/3960-137-0x000000001B5E0000-0x000000001B5E2000-memory.dmpFilesize
8KB