Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    20-03-2022 03:34

General

  • Target

    a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe

  • Size

    3.2MB

  • MD5

    562a9f62a55034e9c8aa9bbfa9850b16

  • SHA1

    3b23806194ebfd8ba2215a0f11d9b0199791fe80

  • SHA256

    a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff

  • SHA512

    896b605c64f97323402cf45d2f0f505fd518344b9e96971a3b46d8ab972d7b8fbc48ac6d02d3c2e29da0311f37f97181eb1b6b2e79a3036d4ff02d22f4b86ce6

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

hacker

C2

2.tcp.ngrok.io:17639

Mutex

7cf40e6a3924b89f8051713ab507eec7

Attributes
  • reg_key

    7cf40e6a3924b89f8051713ab507eec7

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe
    "C:\Users\Admin\AppData\Local\Temp\a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3900
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4836
        • C:\Windows\SysWOW64\fondue.exe
          "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2468
          • C:\Windows\system32\FonDUE.EXE
            "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
            5⤵
              PID:3616
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x2f4 0x2ec
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4376

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.png
      MD5

      340b294efc691d1b20c64175d565ebc7

      SHA1

      81cb9649bd1c9a62ae79e781818fc24d15c29ce7

      SHA256

      72566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9

      SHA512

      1395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cdd
      MD5

      3e7ecaeb51c2812d13b07ec852d74aaf

      SHA1

      e9bdab93596ffb0f7f8c65243c579180939acb26

      SHA256

      e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96

      SHA512

      635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      MD5

      424bf196deaeb4ddcafb78e137fa560a

      SHA1

      007738e9486c904a3115daa6e8ba2ee692af58c8

      SHA256

      0963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2

      SHA512

      a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      MD5

      424bf196deaeb4ddcafb78e137fa560a

      SHA1

      007738e9486c904a3115daa6e8ba2ee692af58c8

      SHA256

      0963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2

      SHA512

      a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.dat
      MD5

      32687f1be72453b7719a386a0cdb84ca

      SHA1

      1da4226e6fd96db2a0e891dce2a95a13efd19e9a

      SHA256

      d2ad96351f6c8178149cb1d7d15a476e9c1064681f2499ba10a557740d0ae605

      SHA512

      0d5cb84f46b1ecdeb1c08ff82d304eace186003d9de1849d5772d332c5779596bb24dec3cf89f6eff21914c5a509a541eaed03f08781ef9598cc38bcf4850340

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
      MD5

      0a625d6ba8cb88acfcdfc589424d11c5

      SHA1

      28eacd9a15b0bb1d72e5f4303f33087deb7284c3

      SHA256

      6d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82

      SHA512

      20bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
      MD5

      0a625d6ba8cb88acfcdfc589424d11c5

      SHA1

      28eacd9a15b0bb1d72e5f4303f33087deb7284c3

      SHA256

      6d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82

      SHA512

      20bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settings
      MD5

      68934a3e9455fa72420237eb05902327

      SHA1

      7cb6efb98ba5972a9b5090dc2e517fe14d12cb04

      SHA256

      fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

      SHA512

      719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll
      MD5

      c3256800dce47c14acc83ccca4c3e2ac

      SHA1

      9d126818c66991dbc3813a65eddb88bbcf77f30a

      SHA256

      f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866

      SHA512

      6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll
      MD5

      c3256800dce47c14acc83ccca4c3e2ac

      SHA1

      9d126818c66991dbc3813a65eddb88bbcf77f30a

      SHA256

      f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866

      SHA512

      6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25