Analysis
-
max time kernel
301s -
max time network
310s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
31-08-2021 02:16
Static task
static1
Behavioral task
behavioral1
Sample
456-Invoice.js
Resource
win7v20210408
General
-
Target
456-Invoice.js
-
Size
166KB
-
MD5
c000b245272ad81b74958689e4b3352e
-
SHA1
ce74042c88b852c6a5b00186096f0ce42afc38b6
-
SHA256
f19462db16c63e8c26095f8ee024340649e0b2cb26a9ba9d08691b6d01e4f2be
-
SHA512
f9b3f811a4be2bee356d9265d15a20a00d41b4a5933d8ab5adcf683ce23cab0ac0b6a7cbdbc97abb509385082aa038d11f1b4f8e502f61e6a42535bbd4df155c
Malware Config
Extracted
njrat
0.7.3
SUCCEED
194.5.97.156:7654
Client.exe
-
reg_key
Client.exe
-
splitter
0149266241@@@
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Blocklisted process makes network request 36 IoCs
Processes:
wscript.exeflow pid process 10 3692 wscript.exe 16 3692 wscript.exe 20 3692 wscript.exe 21 3692 wscript.exe 22 3692 wscript.exe 23 3692 wscript.exe 24 3692 wscript.exe 25 3692 wscript.exe 26 3692 wscript.exe 27 3692 wscript.exe 28 3692 wscript.exe 29 3692 wscript.exe 30 3692 wscript.exe 31 3692 wscript.exe 32 3692 wscript.exe 33 3692 wscript.exe 34 3692 wscript.exe 35 3692 wscript.exe 36 3692 wscript.exe 37 3692 wscript.exe 38 3692 wscript.exe 39 3692 wscript.exe 40 3692 wscript.exe 41 3692 wscript.exe 42 3692 wscript.exe 43 3692 wscript.exe 44 3692 wscript.exe 45 3692 wscript.exe 46 3692 wscript.exe 47 3692 wscript.exe 48 3692 wscript.exe 49 3692 wscript.exe 50 3692 wscript.exe 51 3692 wscript.exe 52 3692 wscript.exe 53 3692 wscript.exe -
Executes dropped EXE 6 IoCs
Processes:
New Client.exeNew Client.exeNew Client.exeNew Client.exeNew Client.exeNew Client.exepid process 4228 New Client.exe 1680 New Client.exe 2828 New Client.exe 1848 New Client.exe 4640 New Client.exe 4732 New Client.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YgrKtkfSUZ.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YgrKtkfSUZ.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\YgrKtkfSUZ.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4548 schtasks.exe 2972 schtasks.exe 936 schtasks.exe 500 schtasks.exe 2172 schtasks.exe 4348 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
New Client.exedescription pid process Token: SeDebugPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe Token: SeIncBasePriorityPrivilege 4228 New Client.exe Token: 33 4228 New Client.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
wscript.exeNew Client.exeNew Client.exeNew Client.exeNew Client.exeNew Client.exeNew Client.exedescription pid process target process PID 4796 wrote to memory of 3692 4796 wscript.exe wscript.exe PID 4796 wrote to memory of 3692 4796 wscript.exe wscript.exe PID 4796 wrote to memory of 4228 4796 wscript.exe New Client.exe PID 4796 wrote to memory of 4228 4796 wscript.exe New Client.exe PID 4796 wrote to memory of 4228 4796 wscript.exe New Client.exe PID 4228 wrote to memory of 3060 4228 New Client.exe schtasks.exe PID 4228 wrote to memory of 3060 4228 New Client.exe schtasks.exe PID 4228 wrote to memory of 3060 4228 New Client.exe schtasks.exe PID 4228 wrote to memory of 500 4228 New Client.exe schtasks.exe PID 4228 wrote to memory of 500 4228 New Client.exe schtasks.exe PID 4228 wrote to memory of 500 4228 New Client.exe schtasks.exe PID 1680 wrote to memory of 1820 1680 New Client.exe schtasks.exe PID 1680 wrote to memory of 1820 1680 New Client.exe schtasks.exe PID 1680 wrote to memory of 1820 1680 New Client.exe schtasks.exe PID 1680 wrote to memory of 2172 1680 New Client.exe schtasks.exe PID 1680 wrote to memory of 2172 1680 New Client.exe schtasks.exe PID 1680 wrote to memory of 2172 1680 New Client.exe schtasks.exe PID 2828 wrote to memory of 3308 2828 New Client.exe schtasks.exe PID 2828 wrote to memory of 3308 2828 New Client.exe schtasks.exe PID 2828 wrote to memory of 3308 2828 New Client.exe schtasks.exe PID 2828 wrote to memory of 4348 2828 New Client.exe schtasks.exe PID 2828 wrote to memory of 4348 2828 New Client.exe schtasks.exe PID 2828 wrote to memory of 4348 2828 New Client.exe schtasks.exe PID 1848 wrote to memory of 4564 1848 New Client.exe schtasks.exe PID 1848 wrote to memory of 4564 1848 New Client.exe schtasks.exe PID 1848 wrote to memory of 4564 1848 New Client.exe schtasks.exe PID 1848 wrote to memory of 4548 1848 New Client.exe schtasks.exe PID 1848 wrote to memory of 4548 1848 New Client.exe schtasks.exe PID 1848 wrote to memory of 4548 1848 New Client.exe schtasks.exe PID 4640 wrote to memory of 4748 4640 New Client.exe schtasks.exe PID 4640 wrote to memory of 4748 4640 New Client.exe schtasks.exe PID 4640 wrote to memory of 4748 4640 New Client.exe schtasks.exe PID 4640 wrote to memory of 2972 4640 New Client.exe schtasks.exe PID 4640 wrote to memory of 2972 4640 New Client.exe schtasks.exe PID 4640 wrote to memory of 2972 4640 New Client.exe schtasks.exe PID 4732 wrote to memory of 200 4732 New Client.exe schtasks.exe PID 4732 wrote to memory of 200 4732 New Client.exe schtasks.exe PID 4732 wrote to memory of 200 4732 New Client.exe schtasks.exe PID 4732 wrote to memory of 936 4732 New Client.exe schtasks.exe PID 4732 wrote to memory of 936 4732 New Client.exe schtasks.exe PID 4732 wrote to memory of 936 4732 New Client.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\456-Invoice.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\YgrKtkfSUZ.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 13⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\New Client.exe.logMD5
d0fb19799333de6477392550871cc975
SHA18643b6941fd73f8f40811116807a7a3338c7f4ff
SHA256bbe01f6b46b8411243d725ebd189c36447430c5acc6ef341fd265c6ee3e566cc
SHA5125622fe656592834d0004b534defdf8d61ba0afc7d90f6ff4a4e56db2d3ee33a22b0abb9a2f5c1d579b5fa5e435abe8d6d4d7062a14a3967e69ae895d9ba92343
-
C:\Users\Admin\AppData\Local\Temp\New Client.exeMD5
4c1c9fdf28215ae2f0f681349b66bbff
SHA18ab23d0ee7a361c8f29622fa9ba05f6644e24e9a
SHA25650842fb63d2308152a3d6c25bf5c45b2a71906193e299975401e8cc5189abd7a
SHA512f0415187e7f7dc15546ea4bc8e6c53281aa407df064a2d73e0360e796caf807430d7ab565ba842e8d1c58c1bc35eefffcd868042c65357906a625b92064e96c5
-
C:\Users\Admin\AppData\Local\Temp\New Client.exeMD5
4c1c9fdf28215ae2f0f681349b66bbff
SHA18ab23d0ee7a361c8f29622fa9ba05f6644e24e9a
SHA25650842fb63d2308152a3d6c25bf5c45b2a71906193e299975401e8cc5189abd7a
SHA512f0415187e7f7dc15546ea4bc8e6c53281aa407df064a2d73e0360e796caf807430d7ab565ba842e8d1c58c1bc35eefffcd868042c65357906a625b92064e96c5
-
C:\Users\Admin\AppData\Local\Temp\New Client.exeMD5
4c1c9fdf28215ae2f0f681349b66bbff
SHA18ab23d0ee7a361c8f29622fa9ba05f6644e24e9a
SHA25650842fb63d2308152a3d6c25bf5c45b2a71906193e299975401e8cc5189abd7a
SHA512f0415187e7f7dc15546ea4bc8e6c53281aa407df064a2d73e0360e796caf807430d7ab565ba842e8d1c58c1bc35eefffcd868042c65357906a625b92064e96c5
-
C:\Users\Admin\AppData\Local\Temp\New Client.exeMD5
4c1c9fdf28215ae2f0f681349b66bbff
SHA18ab23d0ee7a361c8f29622fa9ba05f6644e24e9a
SHA25650842fb63d2308152a3d6c25bf5c45b2a71906193e299975401e8cc5189abd7a
SHA512f0415187e7f7dc15546ea4bc8e6c53281aa407df064a2d73e0360e796caf807430d7ab565ba842e8d1c58c1bc35eefffcd868042c65357906a625b92064e96c5
-
C:\Users\Admin\AppData\Local\Temp\New Client.exeMD5
4c1c9fdf28215ae2f0f681349b66bbff
SHA18ab23d0ee7a361c8f29622fa9ba05f6644e24e9a
SHA25650842fb63d2308152a3d6c25bf5c45b2a71906193e299975401e8cc5189abd7a
SHA512f0415187e7f7dc15546ea4bc8e6c53281aa407df064a2d73e0360e796caf807430d7ab565ba842e8d1c58c1bc35eefffcd868042c65357906a625b92064e96c5
-
C:\Users\Admin\AppData\Local\Temp\New Client.exeMD5
4c1c9fdf28215ae2f0f681349b66bbff
SHA18ab23d0ee7a361c8f29622fa9ba05f6644e24e9a
SHA25650842fb63d2308152a3d6c25bf5c45b2a71906193e299975401e8cc5189abd7a
SHA512f0415187e7f7dc15546ea4bc8e6c53281aa407df064a2d73e0360e796caf807430d7ab565ba842e8d1c58c1bc35eefffcd868042c65357906a625b92064e96c5
-
C:\Users\Admin\AppData\Local\Temp\New Client.exeMD5
4c1c9fdf28215ae2f0f681349b66bbff
SHA18ab23d0ee7a361c8f29622fa9ba05f6644e24e9a
SHA25650842fb63d2308152a3d6c25bf5c45b2a71906193e299975401e8cc5189abd7a
SHA512f0415187e7f7dc15546ea4bc8e6c53281aa407df064a2d73e0360e796caf807430d7ab565ba842e8d1c58c1bc35eefffcd868042c65357906a625b92064e96c5
-
C:\Users\Admin\AppData\Roaming\YgrKtkfSUZ.jsMD5
4e1188211bc0a1f728e5a97cf47a7105
SHA1740914054d0824fbacf494855eb9121355a49740
SHA256ada3ac15b6fd893f1f8b1a4ad1f6d4cbc86c566c0d5a639c4dda15f4727f2cee
SHA512b37d9c26c44b45e89a4732439480bf6d09e292fb85ef054a4a591cb7228eeef0f8595aeaf12824771c033297ea218996d6e4c9006972c15a58d02b89365b2a14
-
memory/200-141-0x0000000000000000-mapping.dmp
-
memory/500-121-0x0000000000000000-mapping.dmp
-
memory/936-142-0x0000000000000000-mapping.dmp
-
memory/1680-125-0x0000000000F30000-0x0000000000F31000-memory.dmpFilesize
4KB
-
memory/1820-123-0x0000000000000000-mapping.dmp
-
memory/1848-134-0x0000000000B00000-0x0000000000C4A000-memory.dmpFilesize
1.3MB
-
memory/2172-124-0x0000000000000000-mapping.dmp
-
memory/2828-130-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/2972-138-0x0000000000000000-mapping.dmp
-
memory/3060-120-0x0000000000000000-mapping.dmp
-
memory/3308-128-0x0000000000000000-mapping.dmp
-
memory/3692-114-0x0000000000000000-mapping.dmp
-
memory/4228-135-0x0000000002F11000-0x0000000002F12000-memory.dmpFilesize
4KB
-
memory/4228-119-0x0000000002F10000-0x0000000002F11000-memory.dmpFilesize
4KB
-
memory/4228-116-0x0000000000000000-mapping.dmp
-
memory/4348-129-0x0000000000000000-mapping.dmp
-
memory/4548-133-0x0000000000000000-mapping.dmp
-
memory/4564-132-0x0000000000000000-mapping.dmp
-
memory/4640-139-0x0000000001520000-0x0000000001521000-memory.dmpFilesize
4KB
-
memory/4732-143-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/4748-137-0x0000000000000000-mapping.dmp