Analysis
- max time kernel
156s - max time network
157s - platform
windows7_x64 - resource
win7v20210408 - submitted
30/08/2021, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe
- Size 1009KB
- Sample210830-4snfxcbjbx
- SHA256 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d
- MD5 3b7e67075780219f65693e397fa721b8
- SHA1 6cff74dcac65d345f10565268c95003854062f4a
- SHA512 cc5de66f5bab3054068de6e34ca2dff86ee9312036dd3b0d5f370f9821dfefc1c24d15e233000abfbf5da296726b43e14c4845a62428176636aab8bbf1d3f770
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
njrat
Version
-
0.7.3
Botnet
-
Limebot3
C2
-
microsoftdnsbug.duckdns.org:6699
Mutex
-
Client.exe
Attributes
-
reg_key
Client.exe
-
splitter
luffy
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1868 AppVCatalog.exe 1040 AppVCatalog.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1816 set thread context of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1868 set thread context of 1812 1868 AppVCatalog.exe 34 PID 1040 set thread context of 1432 1040 AppVCatalog.exe 38 - autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00040000000130cd-73.dat autoit_exe behavioral1/files/0x00040000000130cd-75.dat autoit_exe behavioral1/files/0x00040000000130cd-89.dat autoit_exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 788 schtasks.exe 840 schtasks.exe 916 schtasks.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 1868 AppVCatalog.exe 1868 AppVCatalog.exe 1040 AppVCatalog.exe 1040 AppVCatalog.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe Token: 33 836 RegAsm.exe Token: SeIncBasePriorityPrivilege 836 RegAsm.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1816 wrote to memory of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1816 wrote to memory of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1816 wrote to memory of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1816 wrote to memory of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1816 wrote to memory of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1816 wrote to memory of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1816 wrote to memory of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1816 wrote to memory of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1816 wrote to memory of 836 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 26 PID 1816 wrote to memory of 788 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 30 PID 1816 wrote to memory of 788 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 30 PID 1816 wrote to memory of 788 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 30 PID 1816 wrote to memory of 788 1816 063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe 30 PID 1860 wrote to memory of 1868 1860 taskeng.exe 33 PID 1860 wrote to memory of 1868 1860 taskeng.exe 33 PID 1860 wrote to memory of 1868 1860 taskeng.exe 33 PID 1860 wrote to memory of 1868 1860 taskeng.exe 33 PID 1868 wrote to memory of 1812 1868 AppVCatalog.exe 34 PID 1868 wrote to memory of 1812 1868 AppVCatalog.exe 34 PID 1868 wrote to memory of 1812 1868 AppVCatalog.exe 34 PID 1868 wrote to memory of 1812 1868 AppVCatalog.exe 34 PID 1868 wrote to memory of 1812 1868 AppVCatalog.exe 34 PID 1868 wrote to memory of 1812 1868 AppVCatalog.exe 34 PID 1868 wrote to memory of 1812 1868 AppVCatalog.exe 34 PID 1868 wrote to memory of 1812 1868 AppVCatalog.exe 34 PID 1868 wrote to memory of 1812 1868 AppVCatalog.exe 34 PID 1868 wrote to memory of 840 1868 AppVCatalog.exe 35 PID 1868 wrote to memory of 840 1868 AppVCatalog.exe 35 PID 1868 wrote to memory of 840 1868 AppVCatalog.exe 35 PID 1868 wrote to memory of 840 1868 AppVCatalog.exe 35 PID 1860 wrote to memory of 1040 1860 taskeng.exe 37 PID 1860 wrote to memory of 1040 1860 taskeng.exe 37 PID 1860 wrote to memory of 1040 1860 taskeng.exe 37 PID 1860 wrote to memory of 1040 1860 taskeng.exe 37 PID 1040 wrote to memory of 1432 1040 AppVCatalog.exe 38 PID 1040 wrote to memory of 1432 1040 AppVCatalog.exe 38 PID 1040 wrote to memory of 1432 1040 AppVCatalog.exe 38 PID 1040 wrote to memory of 1432 1040 AppVCatalog.exe 38 PID 1040 wrote to memory of 1432 1040 AppVCatalog.exe 38 PID 1040 wrote to memory of 1432 1040 AppVCatalog.exe 38 PID 1040 wrote to memory of 1432 1040 AppVCatalog.exe 38 PID 1040 wrote to memory of 1432 1040 AppVCatalog.exe 38 PID 1040 wrote to memory of 1432 1040 AppVCatalog.exe 38 PID 1040 wrote to memory of 916 1040 AppVCatalog.exe 39 PID 1040 wrote to memory of 916 1040 AppVCatalog.exe 39 PID 1040 wrote to memory of 916 1040 AppVCatalog.exe 39 PID 1040 wrote to memory of 916 1040 AppVCatalog.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe"C:\Users\Admin\AppData\Local\Temp\063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:788
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {87B78DA7-B2D6-4C9C-B724-9E432CBF6EB9} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeC:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:1812
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:840
-
-
-
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeC:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:1432
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:916
-
-