Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 14:00
Static task
static1
Behavioral task
behavioral1
Sample
6d436e60c2fb29da147c14256bddd963.exe
Resource
win7-en-20211014
General
-
Target
6d436e60c2fb29da147c14256bddd963.exe
-
Size
208KB
-
MD5
6d436e60c2fb29da147c14256bddd963
-
SHA1
196830c4cee77e799789001c65b866ef7755e250
-
SHA256
9fad723dade78cd386645103e1683620b5d1f03b17ae358bdb176c61c3a641fe
-
SHA512
3c0200f49aa036c1e148da156bf9e21b3c071c51e7624d5774da6a51bde46e7cf15af0dc1d1c599b7c76619833165f60aa44edb110ccc058aa1b62dce2f33e9c
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
titopeo1.duckdns.org:9780
42fbf86d0d6541e3b
-
reg_key
42fbf86d0d6541e3b
-
splitter
@!#&^%$
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6d436e60c2fb29da147c14256bddd963.exedescription pid process target process PID 3320 set thread context of 648 3320 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
6d436e60c2fb29da147c14256bddd963.exedescription pid process Token: SeDebugPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe Token: 33 648 6d436e60c2fb29da147c14256bddd963.exe Token: SeIncBasePriorityPrivilege 648 6d436e60c2fb29da147c14256bddd963.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
6d436e60c2fb29da147c14256bddd963.exedescription pid process target process PID 3320 wrote to memory of 512 3320 6d436e60c2fb29da147c14256bddd963.exe schtasks.exe PID 3320 wrote to memory of 512 3320 6d436e60c2fb29da147c14256bddd963.exe schtasks.exe PID 3320 wrote to memory of 512 3320 6d436e60c2fb29da147c14256bddd963.exe schtasks.exe PID 3320 wrote to memory of 648 3320 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 3320 wrote to memory of 648 3320 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 3320 wrote to memory of 648 3320 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 3320 wrote to memory of 648 3320 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 3320 wrote to memory of 648 3320 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 3320 wrote to memory of 648 3320 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 3320 wrote to memory of 648 3320 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe PID 3320 wrote to memory of 648 3320 6d436e60c2fb29da147c14256bddd963.exe 6d436e60c2fb29da147c14256bddd963.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d436e60c2fb29da147c14256bddd963.exe"C:\Users\Admin\AppData\Local\Temp\6d436e60c2fb29da147c14256bddd963.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uwRmhIiZFjs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp72F9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\6d436e60c2fb29da147c14256bddd963.exe"C:\Users\Admin\AppData\Local\Temp\6d436e60c2fb29da147c14256bddd963.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6d436e60c2fb29da147c14256bddd963.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/512-124-0x0000000000000000-mapping.dmp
-
memory/648-135-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/648-133-0x0000000004E70000-0x000000000536E000-memory.dmpFilesize
5.0MB
-
memory/648-126-0x000000000040677E-mapping.dmp
-
memory/648-125-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3320-119-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/3320-123-0x00000000076B0000-0x00000000076DA000-memory.dmpFilesize
168KB
-
memory/3320-122-0x0000000008F90000-0x0000000008F91000-memory.dmpFilesize
4KB
-
memory/3320-121-0x0000000005C70000-0x0000000005C78000-memory.dmpFilesize
32KB
-
memory/3320-120-0x00000000057F0000-0x0000000005882000-memory.dmpFilesize
584KB
-
memory/3320-115-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/3320-118-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/3320-117-0x0000000005E50000-0x0000000005E51000-memory.dmpFilesize
4KB