62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59

General
Target

62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe

Filesize

55KB

Completed

24-09-2021 06:19

Score
10 /10
MD5

c88342b7f4b583c47b42dc05640b4056

SHA1

7be1282dcf2ef52f83532eb25217c66ed7084aa5

SHA256

62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59

Malware Config

Extracted

Family njrat
Version 0.7d
Botnet @ HaCkInG By Dr WeSt @
C2

w187.ddns.net:2020

Attributes
reg_key
4ef9538b5a577a1bd3c1a578ea50c133
splitter
|'|'|
Signatures 8

Filter: none

Discovery
Persistence
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

  • Executes dropped EXE
    [Mr.Abu Hani].exeWindows Audio Device Graph Isolation .exe

    Reported IOCs

    pidprocess
    2040[Mr.Abu Hani].exe
    1752Windows Audio Device Graph Isolation .exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Drops startup file
    Windows Audio Device Graph Isolation .exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4ef9538b5a577a1bd3c1a578ea50c133.exeWindows Audio Device Graph Isolation .exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4ef9538b5a577a1bd3c1a578ea50c133.exeWindows Audio Device Graph Isolation .exe
  • Loads dropped DLL
    62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe[Mr.Abu Hani].exe

    Reported IOCs

    pidprocess
    166062cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe
    166062cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe
    2040[Mr.Abu Hani].exe
    2040[Mr.Abu Hani].exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious use of AdjustPrivilegeToken
    Windows Audio Device Graph Isolation .exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
    Token: 331752Windows Audio Device Graph Isolation .exe
    Token: SeIncBasePriorityPrivilege1752Windows Audio Device Graph Isolation .exe
  • Suspicious use of WriteProcessMemory
    62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe[Mr.Abu Hani].exeWindows Audio Device Graph Isolation .exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1660 wrote to memory of 2040166062cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe[Mr.Abu Hani].exe
    PID 1660 wrote to memory of 2040166062cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe[Mr.Abu Hani].exe
    PID 1660 wrote to memory of 2040166062cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe[Mr.Abu Hani].exe
    PID 1660 wrote to memory of 2040166062cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe[Mr.Abu Hani].exe
    PID 2040 wrote to memory of 17522040[Mr.Abu Hani].exeWindows Audio Device Graph Isolation .exe
    PID 2040 wrote to memory of 17522040[Mr.Abu Hani].exeWindows Audio Device Graph Isolation .exe
    PID 2040 wrote to memory of 17522040[Mr.Abu Hani].exeWindows Audio Device Graph Isolation .exe
    PID 2040 wrote to memory of 17522040[Mr.Abu Hani].exeWindows Audio Device Graph Isolation .exe
    PID 1752 wrote to memory of 10441752Windows Audio Device Graph Isolation .exenetsh.exe
    PID 1752 wrote to memory of 10441752Windows Audio Device Graph Isolation .exenetsh.exe
    PID 1752 wrote to memory of 10441752Windows Audio Device Graph Isolation .exenetsh.exe
    PID 1752 wrote to memory of 10441752Windows Audio Device Graph Isolation .exenetsh.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe
    "C:\Users\Admin\AppData\Local\Temp\62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe"
    Loads dropped DLL
    Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exe
      "C:\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exe"
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe
        "C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe"
        Executes dropped EXE
        Drops startup file
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe" "Windows Audio Device Graph Isolation .exe" ENABLE
          PID:1044
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exe

                        MD5

                        1b6071dc1c6ca35c780dc5dcf5392ba3

                        SHA1

                        c331def6c09f8c82bc71826b9df035e8fcc5059d

                        SHA256

                        89a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721

                        SHA512

                        7b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56

                      • C:\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exe

                        MD5

                        1b6071dc1c6ca35c780dc5dcf5392ba3

                        SHA1

                        c331def6c09f8c82bc71826b9df035e8fcc5059d

                        SHA256

                        89a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721

                        SHA512

                        7b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56

                      • C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe

                        MD5

                        1b6071dc1c6ca35c780dc5dcf5392ba3

                        SHA1

                        c331def6c09f8c82bc71826b9df035e8fcc5059d

                        SHA256

                        89a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721

                        SHA512

                        7b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56

                      • C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe

                        MD5

                        1b6071dc1c6ca35c780dc5dcf5392ba3

                        SHA1

                        c331def6c09f8c82bc71826b9df035e8fcc5059d

                        SHA256

                        89a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721

                        SHA512

                        7b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56

                      • \Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exe

                        MD5

                        1b6071dc1c6ca35c780dc5dcf5392ba3

                        SHA1

                        c331def6c09f8c82bc71826b9df035e8fcc5059d

                        SHA256

                        89a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721

                        SHA512

                        7b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56

                      • \Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exe

                        MD5

                        1b6071dc1c6ca35c780dc5dcf5392ba3

                        SHA1

                        c331def6c09f8c82bc71826b9df035e8fcc5059d

                        SHA256

                        89a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721

                        SHA512

                        7b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56

                      • \Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe

                        MD5

                        1b6071dc1c6ca35c780dc5dcf5392ba3

                        SHA1

                        c331def6c09f8c82bc71826b9df035e8fcc5059d

                        SHA256

                        89a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721

                        SHA512

                        7b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56

                      • \Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe

                        MD5

                        1b6071dc1c6ca35c780dc5dcf5392ba3

                        SHA1

                        c331def6c09f8c82bc71826b9df035e8fcc5059d

                        SHA256

                        89a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721

                        SHA512

                        7b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56

                      • memory/1044-78-0x0000000000000000-mapping.dmp

                      • memory/1660-60-0x0000000000400000-0x0000000000401000-memory.dmp

                      • memory/1660-63-0x0000000004670000-0x0000000004671000-memory.dmp

                      • memory/1660-62-0x00000000762C1000-0x00000000762C3000-memory.dmp

                      • memory/1752-73-0x0000000000000000-mapping.dmp

                      • memory/1752-77-0x0000000002080000-0x0000000002081000-memory.dmp

                      • memory/2040-66-0x0000000000000000-mapping.dmp

                      • memory/2040-70-0x0000000000280000-0x0000000000281000-memory.dmp