Analysis
- max time kernel
157s - max time network
191s - platform
windows7_x64 - resource
win7v20210408 - submitted
31/08/2021, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe
- Size 1009KB
- Sample210831-ads4qphsb2
- SHA256 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf
- MD5 58ad9622adf709180ce51c9ec8fb2091
- SHA1 5faf87bff2c9a2255328b934d0da4427239459ec
- SHA512 1875379f37b8b1a4ebe935bd1f2eb0b47214d2e38da69bdace31b055008992154d237fb6c1ccb9e2a898ed77ba8da3b22a3dc7831daf9b05d585c5541c097304
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
njrat
Version
-
0.7.3
Botnet
-
Limebot3
C2
-
microsoftdnsbug.duckdns.org:6699
Mutex
-
Client.exe
Attributes
-
reg_key
Client.exe
-
splitter
luffy
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1348 AppVCatalog.exe 1600 AppVCatalog.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2028 set thread context of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 1348 set thread context of 336 1348 AppVCatalog.exe 34 PID 1600 set thread context of 1580 1600 AppVCatalog.exe 38 - autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00040000000130cc-73.dat autoit_exe behavioral1/files/0x00040000000130cc-75.dat autoit_exe behavioral1/files/0x00040000000130cc-89.dat autoit_exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1796 schtasks.exe 1784 schtasks.exe 1356 schtasks.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 1348 AppVCatalog.exe 1348 AppVCatalog.exe 1600 AppVCatalog.exe 1600 AppVCatalog.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe Token: 33 1744 RegAsm.exe Token: SeIncBasePriorityPrivilege 1744 RegAsm.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 2028 wrote to memory of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 2028 wrote to memory of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 2028 wrote to memory of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 2028 wrote to memory of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 2028 wrote to memory of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 2028 wrote to memory of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 2028 wrote to memory of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 2028 wrote to memory of 1744 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 29 PID 2028 wrote to memory of 1796 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 30 PID 2028 wrote to memory of 1796 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 30 PID 2028 wrote to memory of 1796 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 30 PID 2028 wrote to memory of 1796 2028 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe 30 PID 428 wrote to memory of 1348 428 taskeng.exe 33 PID 428 wrote to memory of 1348 428 taskeng.exe 33 PID 428 wrote to memory of 1348 428 taskeng.exe 33 PID 428 wrote to memory of 1348 428 taskeng.exe 33 PID 1348 wrote to memory of 336 1348 AppVCatalog.exe 34 PID 1348 wrote to memory of 336 1348 AppVCatalog.exe 34 PID 1348 wrote to memory of 336 1348 AppVCatalog.exe 34 PID 1348 wrote to memory of 336 1348 AppVCatalog.exe 34 PID 1348 wrote to memory of 336 1348 AppVCatalog.exe 34 PID 1348 wrote to memory of 336 1348 AppVCatalog.exe 34 PID 1348 wrote to memory of 336 1348 AppVCatalog.exe 34 PID 1348 wrote to memory of 336 1348 AppVCatalog.exe 34 PID 1348 wrote to memory of 336 1348 AppVCatalog.exe 34 PID 1348 wrote to memory of 1784 1348 AppVCatalog.exe 35 PID 1348 wrote to memory of 1784 1348 AppVCatalog.exe 35 PID 1348 wrote to memory of 1784 1348 AppVCatalog.exe 35 PID 1348 wrote to memory of 1784 1348 AppVCatalog.exe 35 PID 428 wrote to memory of 1600 428 taskeng.exe 37 PID 428 wrote to memory of 1600 428 taskeng.exe 37 PID 428 wrote to memory of 1600 428 taskeng.exe 37 PID 428 wrote to memory of 1600 428 taskeng.exe 37 PID 1600 wrote to memory of 1580 1600 AppVCatalog.exe 38 PID 1600 wrote to memory of 1580 1600 AppVCatalog.exe 38 PID 1600 wrote to memory of 1580 1600 AppVCatalog.exe 38 PID 1600 wrote to memory of 1580 1600 AppVCatalog.exe 38 PID 1600 wrote to memory of 1580 1600 AppVCatalog.exe 38 PID 1600 wrote to memory of 1580 1600 AppVCatalog.exe 38 PID 1600 wrote to memory of 1580 1600 AppVCatalog.exe 38 PID 1600 wrote to memory of 1580 1600 AppVCatalog.exe 38 PID 1600 wrote to memory of 1580 1600 AppVCatalog.exe 38 PID 1600 wrote to memory of 1356 1600 AppVCatalog.exe 39 PID 1600 wrote to memory of 1356 1600 AppVCatalog.exe 39 PID 1600 wrote to memory of 1356 1600 AppVCatalog.exe 39 PID 1600 wrote to memory of 1356 1600 AppVCatalog.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe"C:\Users\Admin\AppData\Local\Temp\c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1796
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E3BD5AA5-401D-4014-8C06-239F4EF27D08} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeC:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:336
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1784
-
-
-
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeC:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:1580
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1356
-
-