Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
09-03-2022 17:48
Static task
static1
Behavioral task
behavioral1
Sample
1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe
Resource
win10v2004-en-20220113
General
-
Target
1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe
-
Size
3.2MB
-
MD5
37185cf06ca09e939d74fa52692cd2bb
-
SHA1
28d3d5093cb8e9a4cb41e27c345a755d171c4c91
-
SHA256
1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17
-
SHA512
4a68a39f7c8c978f9762a0f6347002572e438503b202696c499eedcb60db6bf5bdc260ec6471db4a608a51c97349aa18dd6cadf84487e21e9f10c2043e54f1a2
Malware Config
Extracted
njrat
im523
hacker
0.tcp.ngrok.io:15460
e16fcebad3ce9184f9d944ae59ba0549
-
reg_key
e16fcebad3ce9184f9d944ae59ba0549
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
CDS.execrypted.exepid process 3812 CDS.exe 620 crypted.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CDS.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation CDS.exe -
Loads dropped DLL 1 IoCs
Processes:
CDS.exepid process 3812 CDS.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
CDS.exepid process 3812 CDS.exe 3812 CDS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 4184 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4184 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
CDS.exepid process 3812 CDS.exe 3812 CDS.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exeCDS.execrypted.exefondue.exedescription pid process target process PID 1012 wrote to memory of 3812 1012 1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe CDS.exe PID 1012 wrote to memory of 3812 1012 1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe CDS.exe PID 1012 wrote to memory of 3812 1012 1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe CDS.exe PID 3812 wrote to memory of 620 3812 CDS.exe crypted.exe PID 3812 wrote to memory of 620 3812 CDS.exe crypted.exe PID 3812 wrote to memory of 620 3812 CDS.exe crypted.exe PID 620 wrote to memory of 1320 620 crypted.exe fondue.exe PID 620 wrote to memory of 1320 620 crypted.exe fondue.exe PID 620 wrote to memory of 1320 620 crypted.exe fondue.exe PID 1320 wrote to memory of 1408 1320 fondue.exe FonDUE.EXE PID 1320 wrote to memory of 1408 1320 fondue.exe FonDUE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe"C:\Users\Admin\AppData\Local\Temp\1f67b271e2ab95fd8889b0f95752e17d4b489ea8bd51fff3e23d9e48e8b54c17.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll4⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\system32\FonDUE.EXE"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll5⤵PID:1408
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4fc 0x3081⤵
- Suspicious use of AdjustPrivilegeToken
PID:4184
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.pngMD5
340b294efc691d1b20c64175d565ebc7
SHA181cb9649bd1c9a62ae79e781818fc24d15c29ce7
SHA25672566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9
SHA5121395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cddMD5
3e7ecaeb51c2812d13b07ec852d74aaf
SHA1e9bdab93596ffb0f7f8c65243c579180939acb26
SHA256e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96
SHA512635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeMD5
424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeMD5
424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.datMD5
cfcc6c116bbafc7edc788d23aef4e42e
SHA193059f9e73432101df03c8aae9212a520924c1a6
SHA2567b6c3336aadbf0e04354091bec671ec910d0ab84c8d1efc41e78ce54a396dcc6
SHA5129ba5d175d4f4758e4a0be01c8c4902e7ac170b23547f5276f921e032579af08147fc112436e430855e128dc51784a4511511a43417670139633d8d86d6b1ea9d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeMD5
74eb284f990f386a431b29aa283b183a
SHA13d3b105507f2eb10401ff85d3dccb362bfa4be2c
SHA256b7e864e25004fd10aa5af16c6cf43ef370dc8c1cb76deaaa684eef4291d5faa4
SHA512d472d64de342a9197ea4d7cedf14ebf1a3ca7cd16a5f76218e0cf299b504e871f70345f9ce6960bb822d28345a4b4143b78aabc4a3abd8e45c2938e46eda5011
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeMD5
74eb284f990f386a431b29aa283b183a
SHA13d3b105507f2eb10401ff85d3dccb362bfa4be2c
SHA256b7e864e25004fd10aa5af16c6cf43ef370dc8c1cb76deaaa684eef4291d5faa4
SHA512d472d64de342a9197ea4d7cedf14ebf1a3ca7cd16a5f76218e0cf299b504e871f70345f9ce6960bb822d28345a4b4143b78aabc4a3abd8e45c2938e46eda5011
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settingsMD5
68934a3e9455fa72420237eb05902327
SHA17cb6efb98ba5972a9b5090dc2e517fe14d12cb04
SHA256fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
SHA512719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllMD5
c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllMD5
c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25