Analysis
- max time kernel
152s - max time network
155s - platform
windows7_x64 - resource
win7v20210408 - submitted
30/08/2021, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe
- Size 1009KB
- Sample210830-shfhhxeeb6
- SHA256 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca
- MD5 48f6e580a94cf841c495afa5c50e96a6
- SHA1 e50a3a337524a6a3a638ed33828fda110bbd8d3a
- SHA512 3fbef618e474b76feb407b44a892e59c391b09ca6e6c13d589144fe4edee2892101cbf4234075c66d0d2707614c5f4ca5709f0d99459150f1a3fbd66b19abab0
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
njrat
Version
-
0.7.3
Botnet
-
Limebot3
C2
-
microsoftdnsbug.duckdns.org:6699
Mutex
-
Client.exe
Attributes
-
reg_key
Client.exe
-
splitter
luffy
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1012 AppVCatalog.exe 1688 AppVCatalog.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1288 set thread context of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1012 set thread context of 988 1012 AppVCatalog.exe 34 PID 1688 set thread context of 1752 1688 AppVCatalog.exe 38 - autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00040000000130dd-73.dat autoit_exe behavioral1/files/0x00040000000130dd-75.dat autoit_exe behavioral1/files/0x00040000000130dd-89.dat autoit_exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1316 schtasks.exe 540 schtasks.exe 912 schtasks.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 1012 AppVCatalog.exe 1012 AppVCatalog.exe 1688 AppVCatalog.exe 1688 AppVCatalog.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1288 wrote to memory of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1288 wrote to memory of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1288 wrote to memory of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1288 wrote to memory of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1288 wrote to memory of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1288 wrote to memory of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1288 wrote to memory of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1288 wrote to memory of 1168 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 26 PID 1288 wrote to memory of 1316 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 30 PID 1288 wrote to memory of 1316 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 30 PID 1288 wrote to memory of 1316 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 30 PID 1288 wrote to memory of 1316 1288 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe 30 PID 480 wrote to memory of 1012 480 taskeng.exe 33 PID 480 wrote to memory of 1012 480 taskeng.exe 33 PID 480 wrote to memory of 1012 480 taskeng.exe 33 PID 480 wrote to memory of 1012 480 taskeng.exe 33 PID 1012 wrote to memory of 988 1012 AppVCatalog.exe 34 PID 1012 wrote to memory of 988 1012 AppVCatalog.exe 34 PID 1012 wrote to memory of 988 1012 AppVCatalog.exe 34 PID 1012 wrote to memory of 988 1012 AppVCatalog.exe 34 PID 1012 wrote to memory of 988 1012 AppVCatalog.exe 34 PID 1012 wrote to memory of 988 1012 AppVCatalog.exe 34 PID 1012 wrote to memory of 988 1012 AppVCatalog.exe 34 PID 1012 wrote to memory of 988 1012 AppVCatalog.exe 34 PID 1012 wrote to memory of 988 1012 AppVCatalog.exe 34 PID 1012 wrote to memory of 540 1012 AppVCatalog.exe 35 PID 1012 wrote to memory of 540 1012 AppVCatalog.exe 35 PID 1012 wrote to memory of 540 1012 AppVCatalog.exe 35 PID 1012 wrote to memory of 540 1012 AppVCatalog.exe 35 PID 480 wrote to memory of 1688 480 taskeng.exe 37 PID 480 wrote to memory of 1688 480 taskeng.exe 37 PID 480 wrote to memory of 1688 480 taskeng.exe 37 PID 480 wrote to memory of 1688 480 taskeng.exe 37 PID 1688 wrote to memory of 1752 1688 AppVCatalog.exe 38 PID 1688 wrote to memory of 1752 1688 AppVCatalog.exe 38 PID 1688 wrote to memory of 1752 1688 AppVCatalog.exe 38 PID 1688 wrote to memory of 1752 1688 AppVCatalog.exe 38 PID 1688 wrote to memory of 1752 1688 AppVCatalog.exe 38 PID 1688 wrote to memory of 1752 1688 AppVCatalog.exe 38 PID 1688 wrote to memory of 1752 1688 AppVCatalog.exe 38 PID 1688 wrote to memory of 1752 1688 AppVCatalog.exe 38 PID 1688 wrote to memory of 1752 1688 AppVCatalog.exe 38 PID 1688 wrote to memory of 912 1688 AppVCatalog.exe 39 PID 1688 wrote to memory of 912 1688 AppVCatalog.exe 39 PID 1688 wrote to memory of 912 1688 AppVCatalog.exe 39 PID 1688 wrote to memory of 912 1688 AppVCatalog.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe"C:\Users\Admin\AppData\Local\Temp\f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1316
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {3265A315-795C-42D6-A47C-4E2E0B51CDDF} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeC:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:988
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:540
-
-
-
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeC:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:1752
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:912
-
-