Analysis
-
max time kernel
150s -
max time network
178s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-09-2021 14:52
Behavioral task
behavioral1
Sample
E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exe
Resource
win7v20210408
General
-
Target
E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exe
-
Size
23KB
-
MD5
ff0a76f55ded419451bc43c4ada07442
-
SHA1
db1649fe991ddd2d24695f4bc87846dd53f6ee70
-
SHA256
e54869035cad0883d23a9876b2f2a2933c238a3493f98e4e708de09e8775f13b
-
SHA512
d26bf759a1fc39b5686fc8d281f1395c7743c78b3e7e7be81ddb6faf434efee0f3422a14dea2ec7bb3278b95dc941b676ebca6ec9742d7b52c4a47790411e842
Malware Config
Extracted
njrat
0.7d
HacKed
loveyou1.zapto.org:9090
30babc74a83b1275096945fbac125560
-
reg_key
30babc74a83b1275096945fbac125560
-
splitter
|'|'|
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE 1 IoCs
Processes:
GoogleCrash.exepid process 1472 GoogleCrash.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
GoogleCrash.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\30babc74a83b1275096945fbac125560.exe GoogleCrash.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\30babc74a83b1275096945fbac125560.exe GoogleCrash.exe -
Loads dropped DLL 1 IoCs
Processes:
E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exepid process 800 E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
GoogleCrash.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\30babc74a83b1275096945fbac125560 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\GoogleCrash.exe\" .." GoogleCrash.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\30babc74a83b1275096945fbac125560 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\GoogleCrash.exe\" .." GoogleCrash.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
GoogleCrash.exedescription pid process Token: SeDebugPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe Token: 33 1472 GoogleCrash.exe Token: SeIncBasePriorityPrivilege 1472 GoogleCrash.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exeGoogleCrash.exedescription pid process target process PID 800 wrote to memory of 1472 800 E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exe GoogleCrash.exe PID 800 wrote to memory of 1472 800 E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exe GoogleCrash.exe PID 800 wrote to memory of 1472 800 E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exe GoogleCrash.exe PID 800 wrote to memory of 1472 800 E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exe GoogleCrash.exe PID 1472 wrote to memory of 1652 1472 GoogleCrash.exe netsh.exe PID 1472 wrote to memory of 1652 1472 GoogleCrash.exe netsh.exe PID 1472 wrote to memory of 1652 1472 GoogleCrash.exe netsh.exe PID 1472 wrote to memory of 1652 1472 GoogleCrash.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exe"C:\Users\Admin\AppData\Local\Temp\E54869035CAD0883D23A9876B2F2A2933C238A3493F98.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GoogleCrash.exe"C:\Users\Admin\AppData\Local\Temp\GoogleCrash.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\GoogleCrash.exe" "GoogleCrash.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GoogleCrash.exeMD5
ff0a76f55ded419451bc43c4ada07442
SHA1db1649fe991ddd2d24695f4bc87846dd53f6ee70
SHA256e54869035cad0883d23a9876b2f2a2933c238a3493f98e4e708de09e8775f13b
SHA512d26bf759a1fc39b5686fc8d281f1395c7743c78b3e7e7be81ddb6faf434efee0f3422a14dea2ec7bb3278b95dc941b676ebca6ec9742d7b52c4a47790411e842
-
C:\Users\Admin\AppData\Local\Temp\GoogleCrash.exeMD5
ff0a76f55ded419451bc43c4ada07442
SHA1db1649fe991ddd2d24695f4bc87846dd53f6ee70
SHA256e54869035cad0883d23a9876b2f2a2933c238a3493f98e4e708de09e8775f13b
SHA512d26bf759a1fc39b5686fc8d281f1395c7743c78b3e7e7be81ddb6faf434efee0f3422a14dea2ec7bb3278b95dc941b676ebca6ec9742d7b52c4a47790411e842
-
\Users\Admin\AppData\Local\Temp\GoogleCrash.exeMD5
ff0a76f55ded419451bc43c4ada07442
SHA1db1649fe991ddd2d24695f4bc87846dd53f6ee70
SHA256e54869035cad0883d23a9876b2f2a2933c238a3493f98e4e708de09e8775f13b
SHA512d26bf759a1fc39b5686fc8d281f1395c7743c78b3e7e7be81ddb6faf434efee0f3422a14dea2ec7bb3278b95dc941b676ebca6ec9742d7b52c4a47790411e842
-
memory/800-59-0x0000000075051000-0x0000000075053000-memory.dmpFilesize
8KB
-
memory/800-60-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/1472-62-0x0000000000000000-mapping.dmp
-
memory/1472-66-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1652-67-0x0000000000000000-mapping.dmp