dffffd.exe

General
Target

dffffd.exe

Filesize

661KB

Completed

22-09-2021 17:10

Score
10 /10
MD5

75877c7f6a8b5a2642c5b3c389444394

SHA1

9168024a9c3a28d5be15953eccaeb5bff68b9601

SHA256

ef8c7077685d93118f27d7c334f60a440b31e127989748078057c5855c35aba9

Malware Config

Extracted

Family njrat
Version v4.0
Botnet Wed_22_GreenLife
C2

37.120.141.158:18892

Attributes
reg_key
Windows
splitter
|-F-|
Signatures 8

Filter: none

Discovery
Persistence
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

  • Drops startup file
    dffffd.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnkdffffd.exe
  • Suspicious use of SetThreadContext
    dffffd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1824 set thread context of 18561824dffffd.exedffffd.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1512schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    dffffd.exe

    Reported IOCs

    pidprocess
    1824dffffd.exe
    1824dffffd.exe
  • Suspicious use of AdjustPrivilegeToken
    dffffd.exedffffd.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1824dffffd.exe
    Token: SeDebugPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
    Token: 331856dffffd.exe
    Token: SeIncBasePriorityPrivilege1856dffffd.exe
  • Suspicious use of WriteProcessMemory
    dffffd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1824 wrote to memory of 15121824dffffd.exeschtasks.exe
    PID 1824 wrote to memory of 15121824dffffd.exeschtasks.exe
    PID 1824 wrote to memory of 15121824dffffd.exeschtasks.exe
    PID 1824 wrote to memory of 15121824dffffd.exeschtasks.exe
    PID 1824 wrote to memory of 18521824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18521824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18521824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18521824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18561824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18561824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18561824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18561824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18561824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18561824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18561824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18561824dffffd.exedffffd.exe
    PID 1824 wrote to memory of 18561824dffffd.exedffffd.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\dffffd.exe
    "C:\Users\Admin\AppData\Local\Temp\dffffd.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kfzQEBrWHDfT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8FEF.tmp"
      Creates scheduled task(s)
      PID:1512
    • C:\Users\Admin\AppData\Local\Temp\dffffd.exe
      "{path}"
      PID:1852
    • C:\Users\Admin\AppData\Local\Temp\dffffd.exe
      "{path}"
      Drops startup file
      Suspicious use of AdjustPrivilegeToken
      PID:1856
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmp8FEF.tmp

                        MD5

                        50acf56b411f8f120e944c3a8095771a

                        SHA1

                        374574a363922cbc6a8bbf27e1d2a9d345e8a7d4

                        SHA256

                        8aa14162aa0bed7cb6417757c9c47b71db6c8dfe20ee6b31cc185d1f427a0290

                        SHA512

                        aa5b343d0e74f1a73d406a5626280634e9aade99b690e64b16cc6fd74471ae680dfda40bd58fefd06a1aef0209959470f16716ea14cdf5d00660af9fb01bf872

                      • memory/1512-66-0x0000000000000000-mapping.dmp

                      • memory/1824-62-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                      • memory/1824-63-0x00000000005B0000-0x00000000005BE000-memory.dmp

                      • memory/1824-64-0x0000000004F40000-0x0000000004F9E000-memory.dmp

                      • memory/1824-65-0x0000000001E10000-0x0000000001E19000-memory.dmp

                      • memory/1824-60-0x00000000001B0000-0x00000000001B1000-memory.dmp

                      • memory/1856-68-0x0000000000400000-0x000000000040E000-memory.dmp

                      • memory/1856-69-0x000000000040838E-mapping.dmp

                      • memory/1856-70-0x0000000000400000-0x000000000040E000-memory.dmp

                      • memory/1856-72-0x0000000005910000-0x0000000005911000-memory.dmp