Analysis
-
max time kernel
155s -
max time network
154s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-09-2021 11:58
Static task
static1
Behavioral task
behavioral1
Sample
41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe
Resource
win7v20210408
General
-
Target
41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe
-
Size
1009KB
-
MD5
2bdfc0cc5cad829995fb730b83c099c8
-
SHA1
3f7a49c990bc5b6fa7df644dd3dd1d7046e35ab5
-
SHA256
41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681
-
SHA512
1563050e048541135b57fef6b14cb14f7a4d95dc63539a1e0677116fef256f1c3fced0aa7fb82567efcc12741c00d4fc37b1b9458e90cbaa3da13ac2f7a3db0d
Malware Config
Extracted
njrat
0.7.3
Limebot3
microsoftdnsbug.duckdns.org:6699
Client.exe
-
reg_key
Client.exe
-
splitter
luffy
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
AppVCatalog.exeAppVCatalog.exepid process 1080 AppVCatalog.exe 1528 AppVCatalog.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exeAppVCatalog.exeAppVCatalog.exedescription pid process target process PID 1848 set thread context of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1080 set thread context of 992 1080 AppVCatalog.exe RegAsm.exe PID 1528 set thread context of 1536 1528 AppVCatalog.exe RegAsm.exe -
autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe autoit_exe C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe autoit_exe C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exeAppVCatalog.exeAppVCatalog.exepid process 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe 1080 AppVCatalog.exe 1080 AppVCatalog.exe 1528 AppVCatalog.exe 1528 AppVCatalog.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe Token: 33 1168 RegAsm.exe Token: SeIncBasePriorityPrivilege 1168 RegAsm.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exetaskeng.exeAppVCatalog.exeAppVCatalog.exedescription pid process target process PID 1848 wrote to memory of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1848 wrote to memory of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1848 wrote to memory of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1848 wrote to memory of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1848 wrote to memory of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1848 wrote to memory of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1848 wrote to memory of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1848 wrote to memory of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1848 wrote to memory of 1168 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe RegAsm.exe PID 1848 wrote to memory of 752 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe schtasks.exe PID 1848 wrote to memory of 752 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe schtasks.exe PID 1848 wrote to memory of 752 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe schtasks.exe PID 1848 wrote to memory of 752 1848 41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe schtasks.exe PID 1512 wrote to memory of 1080 1512 taskeng.exe AppVCatalog.exe PID 1512 wrote to memory of 1080 1512 taskeng.exe AppVCatalog.exe PID 1512 wrote to memory of 1080 1512 taskeng.exe AppVCatalog.exe PID 1512 wrote to memory of 1080 1512 taskeng.exe AppVCatalog.exe PID 1080 wrote to memory of 992 1080 AppVCatalog.exe RegAsm.exe PID 1080 wrote to memory of 992 1080 AppVCatalog.exe RegAsm.exe PID 1080 wrote to memory of 992 1080 AppVCatalog.exe RegAsm.exe PID 1080 wrote to memory of 992 1080 AppVCatalog.exe RegAsm.exe PID 1080 wrote to memory of 992 1080 AppVCatalog.exe RegAsm.exe PID 1080 wrote to memory of 992 1080 AppVCatalog.exe RegAsm.exe PID 1080 wrote to memory of 992 1080 AppVCatalog.exe RegAsm.exe PID 1080 wrote to memory of 992 1080 AppVCatalog.exe RegAsm.exe PID 1080 wrote to memory of 992 1080 AppVCatalog.exe RegAsm.exe PID 1080 wrote to memory of 1052 1080 AppVCatalog.exe schtasks.exe PID 1080 wrote to memory of 1052 1080 AppVCatalog.exe schtasks.exe PID 1080 wrote to memory of 1052 1080 AppVCatalog.exe schtasks.exe PID 1080 wrote to memory of 1052 1080 AppVCatalog.exe schtasks.exe PID 1512 wrote to memory of 1528 1512 taskeng.exe AppVCatalog.exe PID 1512 wrote to memory of 1528 1512 taskeng.exe AppVCatalog.exe PID 1512 wrote to memory of 1528 1512 taskeng.exe AppVCatalog.exe PID 1512 wrote to memory of 1528 1512 taskeng.exe AppVCatalog.exe PID 1528 wrote to memory of 1536 1528 AppVCatalog.exe RegAsm.exe PID 1528 wrote to memory of 1536 1528 AppVCatalog.exe RegAsm.exe PID 1528 wrote to memory of 1536 1528 AppVCatalog.exe RegAsm.exe PID 1528 wrote to memory of 1536 1528 AppVCatalog.exe RegAsm.exe PID 1528 wrote to memory of 1536 1528 AppVCatalog.exe RegAsm.exe PID 1528 wrote to memory of 1536 1528 AppVCatalog.exe RegAsm.exe PID 1528 wrote to memory of 1536 1528 AppVCatalog.exe RegAsm.exe PID 1528 wrote to memory of 1536 1528 AppVCatalog.exe RegAsm.exe PID 1528 wrote to memory of 1536 1528 AppVCatalog.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe"C:\Users\Admin\AppData\Local\Temp\41e16d26226c15800b3dda0529c07e7d17db42cb7d30023849a595df60e44681.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {671F336C-0916-494A-B951-61EEECAAE3B7} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeC:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeC:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeMD5
e44ec2bd804505114edf171c4ebfe816
SHA1fd263c9efcfdcfeabd34584c730956694e2156ab
SHA256509e47c2f06be822dca665ff0d5757f53a3a402c06d6c566373d6a589913e640
SHA512941476ee3296bf00856497be564ea19990941f026296f80c39abd02f1ef51410d4c8fac75d3470a7a214cd2d7ba8e614df93b9e34006a0e0942c0e52f341f939
-
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeMD5
e44ec2bd804505114edf171c4ebfe816
SHA1fd263c9efcfdcfeabd34584c730956694e2156ab
SHA256509e47c2f06be822dca665ff0d5757f53a3a402c06d6c566373d6a589913e640
SHA512941476ee3296bf00856497be564ea19990941f026296f80c39abd02f1ef51410d4c8fac75d3470a7a214cd2d7ba8e614df93b9e34006a0e0942c0e52f341f939
-
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exeMD5
e44ec2bd804505114edf171c4ebfe816
SHA1fd263c9efcfdcfeabd34584c730956694e2156ab
SHA256509e47c2f06be822dca665ff0d5757f53a3a402c06d6c566373d6a589913e640
SHA512941476ee3296bf00856497be564ea19990941f026296f80c39abd02f1ef51410d4c8fac75d3470a7a214cd2d7ba8e614df93b9e34006a0e0942c0e52f341f939
-
memory/752-72-0x0000000000000000-mapping.dmp
-
memory/992-86-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/992-82-0x0000000000414E6E-mapping.dmp
-
memory/1052-87-0x0000000000000000-mapping.dmp
-
memory/1080-74-0x0000000000000000-mapping.dmp
-
memory/1168-67-0x0000000000414E6E-mapping.dmp
-
memory/1168-68-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1168-62-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1168-69-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1168-71-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/1528-88-0x0000000000000000-mapping.dmp
-
memory/1536-96-0x0000000000414E6E-mapping.dmp
-
memory/1536-100-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/1848-60-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1848-61-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB