Analysis
-
max time kernel
60s -
max time network
62s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
20-12-2021 05:10
Behavioral task
behavioral1
Sample
GeforceNow.exe
Resource
win10-en-20211208
General
-
Target
GeforceNow.exe
-
Size
29KB
-
MD5
f1aa4749c6bf4f095862c0a26c32eb26
-
SHA1
99cfe703d358c76b06feccc397c4461e39e02309
-
SHA256
e1a51853ecacc1cc2ecb286ee437e3ec340c78a398e88cab47eaa874ac7af7de
-
SHA512
4e3ab6ba5a010f0e9162cfce693b199d161f5fcb33f5d51bb5948e8aebc281750e58b9d8e1a8cac04e7627afa2adbc584094a840e0e899c46032098d82ae99f2
Malware Config
Extracted
njrat
0.6.4
x33
flubabapro.duckdns.org:53
599ba46d0096edac8ad1cb1ef14e5829
-
reg_key
599ba46d0096edac8ad1cb1ef14e5829
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
riot.exepid process 3248 riot.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
riot.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\599ba46d0096edac8ad1cb1ef14e5829.exe riot.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\599ba46d0096edac8ad1cb1ef14e5829.exe riot.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
riot.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\599ba46d0096edac8ad1cb1ef14e5829 = "\"C:\\Users\\Admin\\riot.exe\" .." riot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\599ba46d0096edac8ad1cb1ef14e5829 = "\"C:\\Users\\Admin\\riot.exe\" .." riot.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
riot.exepid process 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe 3248 riot.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
riot.exedescription pid process Token: SeDebugPrivilege 3248 riot.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
GeforceNow.exeriot.exedescription pid process target process PID 3264 wrote to memory of 3248 3264 GeforceNow.exe riot.exe PID 3264 wrote to memory of 3248 3264 GeforceNow.exe riot.exe PID 3264 wrote to memory of 3248 3264 GeforceNow.exe riot.exe PID 3248 wrote to memory of 1368 3248 riot.exe netsh.exe PID 3248 wrote to memory of 1368 3248 riot.exe netsh.exe PID 3248 wrote to memory of 1368 3248 riot.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GeforceNow.exe"C:\Users\Admin\AppData\Local\Temp\GeforceNow.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\riot.exe"C:\Users\Admin\riot.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\riot.exe" "riot.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\riot.exeMD5
f1aa4749c6bf4f095862c0a26c32eb26
SHA199cfe703d358c76b06feccc397c4461e39e02309
SHA256e1a51853ecacc1cc2ecb286ee437e3ec340c78a398e88cab47eaa874ac7af7de
SHA5124e3ab6ba5a010f0e9162cfce693b199d161f5fcb33f5d51bb5948e8aebc281750e58b9d8e1a8cac04e7627afa2adbc584094a840e0e899c46032098d82ae99f2
-
C:\Users\Admin\riot.exeMD5
f1aa4749c6bf4f095862c0a26c32eb26
SHA199cfe703d358c76b06feccc397c4461e39e02309
SHA256e1a51853ecacc1cc2ecb286ee437e3ec340c78a398e88cab47eaa874ac7af7de
SHA5124e3ab6ba5a010f0e9162cfce693b199d161f5fcb33f5d51bb5948e8aebc281750e58b9d8e1a8cac04e7627afa2adbc584094a840e0e899c46032098d82ae99f2
-
memory/1368-118-0x0000000000000000-mapping.dmp
-
memory/3248-115-0x0000000000000000-mapping.dmp
-
memory/3248-119-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/3264-114-0x00000000007C0000-0x000000000086E000-memory.dmpFilesize
696KB