Analysis
- max time kernel
151s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
14/11/2021, 06:42
Static task
static1
Behavioral task
behavioral1
Sample
BB483E0CB23EAF8FAAA78E28B5899211.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
General
- Target BB483E0CB23EAF8FAAA78E28B5899211.exe
- Size 2.5MB
- Sample211114-hgcyragab2
- SHA256 4a0f711887436496355320a602ea4141f5fceed48cb960e638d9daaee70dd077
- MD5 bb483e0cb23eaf8faaa78e28b5899211
- SHA1 80d17f4bb56fd99c557fbe72debe057bbf54c7f9
- SHA512 be11b7de917665c1c9f993025e1960f95c3dd03c7ce8146bdc5b4038efbd9a52104780681fdaf6f3d70be8f7c717eeabafb964364b422ed15b4e9add79cc754f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
HacKed
C2
-
0.tcp.ngrok.io:11722
Mutex
-
aadcb7aa3c0523a52c6ea2a71565f2d7
Attributes
-
reg_key
aadcb7aa3c0523a52c6ea2a71565f2d7
-
splitter
|'|'|
Extracted
Family
-
redline
Botnet
-
@xxtrez
C2
-
178.20.41.235:41993
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 6 IoCs
resource yara_rule behavioral2/files/0x0007000000000689-119.dat family_redline behavioral2/files/0x0007000000000689-120.dat family_redline behavioral2/files/0x000400000001ab8d-130.dat family_redline behavioral2/files/0x000400000001ab8d-129.dat family_redline behavioral2/files/0x000500000001ab93-136.dat family_redline behavioral2/files/0x000500000001ab93-138.dat family_redline - Executes dropped EXE 5 IoCs
pid Process 1668 1121.exe 2344 ....exe 3796 CSGhost-v4.2.1.exe 2848 Gifanio.exe 1000 Decoder.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aadcb7aa3c0523a52c6ea2a71565f2d7.exe ....exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aadcb7aa3c0523a52c6ea2a71565f2d7.exe ....exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\aadcb7aa3c0523a52c6ea2a71565f2d7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\....exe\" .." ....exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aadcb7aa3c0523a52c6ea2a71565f2d7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\....exe\" .." ....exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 api.ipify.org 13 api.ipify.org 22 ip-api.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Delays execution with timeout.exe 1 IoCs
pid Process 1228 timeout.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings 1121.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings OpenWith.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe 3796 CSGhost-v4.2.1.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2848 Gifanio.exe Token: SeDebugPrivilege 1000 Decoder.exe Token: SeDebugPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe Token: 33 2344 ....exe Token: SeIncBasePriorityPrivilege 2344 ....exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1224 OpenWith.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3120 wrote to memory of 1668 3120 BB483E0CB23EAF8FAAA78E28B5899211.exe 69 PID 3120 wrote to memory of 1668 3120 BB483E0CB23EAF8FAAA78E28B5899211.exe 69 PID 3120 wrote to memory of 1668 3120 BB483E0CB23EAF8FAAA78E28B5899211.exe 69 PID 3120 wrote to memory of 2344 3120 BB483E0CB23EAF8FAAA78E28B5899211.exe 70 PID 3120 wrote to memory of 2344 3120 BB483E0CB23EAF8FAAA78E28B5899211.exe 70 PID 3120 wrote to memory of 2344 3120 BB483E0CB23EAF8FAAA78E28B5899211.exe 70 PID 3120 wrote to memory of 3796 3120 BB483E0CB23EAF8FAAA78E28B5899211.exe 71 PID 3120 wrote to memory of 3796 3120 BB483E0CB23EAF8FAAA78E28B5899211.exe 71 PID 3120 wrote to memory of 3796 3120 BB483E0CB23EAF8FAAA78E28B5899211.exe 71 PID 1668 wrote to memory of 2848 1668 1121.exe 73 PID 1668 wrote to memory of 2848 1668 1121.exe 73 PID 2848 wrote to memory of 1000 2848 Gifanio.exe 75 PID 2848 wrote to memory of 1000 2848 Gifanio.exe 75 PID 2848 wrote to memory of 1000 2848 Gifanio.exe 75 PID 2848 wrote to memory of 740 2848 Gifanio.exe 78 PID 2848 wrote to memory of 740 2848 Gifanio.exe 78 PID 740 wrote to memory of 1228 740 cmd.exe 79 PID 740 wrote to memory of 1228 740 cmd.exe 79 PID 2344 wrote to memory of 1820 2344 ....exe 80 PID 2344 wrote to memory of 1820 2344 ....exe 80 PID 2344 wrote to memory of 1820 2344 ....exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\BB483E0CB23EAF8FAAA78E28B5899211.exe"C:\Users\Admin\AppData\Local\Temp\BB483E0CB23EAF8FAAA78E28B5899211.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\1121.exe"C:\Users\Admin\AppData\Local\Temp\1121.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\Gifanio.exe"C:\Users\Admin\AppData\Local\Temp\Gifanio.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""4⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\system32\timeout.exetimeout 45⤵
- Delays execution with timeout.exe
PID:1228
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\....exe"C:\Users\Admin\AppData\Local\Temp\....exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\....exe" "....exe" ENABLE3⤵PID:1820
-
-
-
C:\Users\Admin\AppData\Local\Temp\CSGhost-v4.2.1.exe"C:\Users\Admin\AppData\Local\Temp\CSGhost-v4.2.1.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3796
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1224