Analysis
-
max time kernel
146s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
20-10-2021 14:00
Static task
static1
Behavioral task
behavioral1
Sample
6d436e60c2fb29da147c14256bddd963.exe
Resource
win7-en-20211014
General
-
Target
6d436e60c2fb29da147c14256bddd963.exe
-
Size
208KB
-
MD5
6d436e60c2fb29da147c14256bddd963
-
SHA1
196830c4cee77e799789001c65b866ef7755e250
-
SHA256
9fad723dade78cd386645103e1683620b5d1f03b17ae358bdb176c61c3a641fe
-
SHA512
3c0200f49aa036c1e148da156bf9e21b3c071c51e7624d5774da6a51bde46e7cf15af0dc1d1c599b7c76619833165f60aa44edb110ccc058aa1b62dce2f33e9c
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
titopeo1.duckdns.org:9780
42fbf86d0d6541e3b
-
reg_key
42fbf86d0d6541e3b
-
splitter
@!#&^%$
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6d436e60c2fb29da147c14256bddd963.exedescription pid process target process PID 1196 set thread context of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
6d436e60c2fb29da147c14256bddd963.exedescription pid process Token: SeDebugPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe Token: 33 1488 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 1488 6d436e60c2fb29da147c14256bddd963.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
6d436e60c2fb29da147c14256bddd963.exedescription pid process target process PID 1196 wrote to memory of 612 1196 6d436e60c2fb29da147c14256bddd963.exe schtasks.exe PID 1196 wrote to memory of 612 1196 6d436e60c2fb29da147c14256bddd963.exe schtasks.exe PID 1196 wrote to memory of 612 1196 6d436e60c2fb29da147c14256bddd963.exe schtasks.exe PID 1196 wrote to memory of 612 1196 6d436e60c2fb29da147c14256bddd963.exe schtasks.exe PID 1196 wrote to memory of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 1196 wrote to memory of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 1196 wrote to memory of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 1196 wrote to memory of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 1196 wrote to memory of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 1196 wrote to memory of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 1196 wrote to memory of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 1196 wrote to memory of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 1196 wrote to memory of 1488 1196 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d436e60c2fb29da147c14256bddd963.exe"C:\Users\Admin\AppData\Local\Temp\6d436e60c2fb29da147c14256bddd963.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uwRmhIiZFjs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9FD8.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\6d436e60c2fb29da147c14256bddd963.exe"C:\Users\Admin\AppData\Local\Temp\6d436e60c2fb29da147c14256bddd963.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/612-60-0x0000000000000000-mapping.dmp
-
memory/1196-54-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/1196-56-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/1196-57-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/1196-58-0x0000000000500000-0x0000000000508000-memory.dmpFilesize
32KB
-
memory/1196-59-0x0000000000700000-0x000000000072A000-memory.dmpFilesize
168KB
-
memory/1488-61-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1488-62-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1488-63-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1488-64-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1488-66-0x000000000040677E-mapping.dmp
-
memory/1488-65-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1488-67-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1488-69-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB