Analysis
-
max time kernel
4294213s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
26-03-2022 18:20
Static task
static1
Behavioral task
behavioral1
Sample
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe
Resource
win10v2004-en-20220113
General
-
Target
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe
-
Size
3.3MB
-
MD5
b25bb6011cd77d3d3b9c9ee6b18c3b06
-
SHA1
7da0bcdf76f7e355f7204eb1c9fc85cb0d970bf1
-
SHA256
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21
-
SHA512
5f67990c474f09d84443f8bd395bb87437e7dbe9906bbe8b38e4b9dd5a5c132cf40bc05d43325dc27de7da558fa470364187f2e572dc46116c828fdea7d22570
Malware Config
Extracted
njrat
im523
system
192.168.56.1:1414
f5f77609bd30b7a81be16e78606bcee3
-
reg_key
f5f77609bd30b7a81be16e78606bcee3
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
CDS.execrypted.exesystem.exepid process 1064 CDS.exe 1936 crypted.exe 1472 system.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 10 IoCs
Processes:
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exeCDS.execrypted.exesystem.exepid process 288 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe 1064 CDS.exe 1064 CDS.exe 1064 CDS.exe 1064 CDS.exe 1064 CDS.exe 1064 CDS.exe 1936 crypted.exe 1936 crypted.exe 1472 system.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
CDS.exepid process 1064 CDS.exe 1064 CDS.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
system.exedescription pid process Token: SeDebugPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe Token: 33 1472 system.exe Token: SeIncBasePriorityPrivilege 1472 system.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
CDS.exepid process 1064 CDS.exe 1064 CDS.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exeCDS.execrypted.exesystem.exedescription pid process target process PID 288 wrote to memory of 1064 288 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe CDS.exe PID 288 wrote to memory of 1064 288 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe CDS.exe PID 288 wrote to memory of 1064 288 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe CDS.exe PID 288 wrote to memory of 1064 288 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe CDS.exe PID 288 wrote to memory of 1064 288 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe CDS.exe PID 288 wrote to memory of 1064 288 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe CDS.exe PID 288 wrote to memory of 1064 288 180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe CDS.exe PID 1064 wrote to memory of 1936 1064 CDS.exe crypted.exe PID 1064 wrote to memory of 1936 1064 CDS.exe crypted.exe PID 1064 wrote to memory of 1936 1064 CDS.exe crypted.exe PID 1064 wrote to memory of 1936 1064 CDS.exe crypted.exe PID 1064 wrote to memory of 1936 1064 CDS.exe crypted.exe PID 1064 wrote to memory of 1936 1064 CDS.exe crypted.exe PID 1064 wrote to memory of 1936 1064 CDS.exe crypted.exe PID 1936 wrote to memory of 1472 1936 crypted.exe system.exe PID 1936 wrote to memory of 1472 1936 crypted.exe system.exe PID 1936 wrote to memory of 1472 1936 crypted.exe system.exe PID 1936 wrote to memory of 1472 1936 crypted.exe system.exe PID 1936 wrote to memory of 1472 1936 crypted.exe system.exe PID 1936 wrote to memory of 1472 1936 crypted.exe system.exe PID 1936 wrote to memory of 1472 1936 crypted.exe system.exe PID 1472 wrote to memory of 1560 1472 system.exe netsh.exe PID 1472 wrote to memory of 1560 1472 system.exe netsh.exe PID 1472 wrote to memory of 1560 1472 system.exe netsh.exe PID 1472 wrote to memory of 1560 1472 system.exe netsh.exe PID 1472 wrote to memory of 1560 1472 system.exe netsh.exe PID 1472 wrote to memory of 1560 1472 system.exe netsh.exe PID 1472 wrote to memory of 1560 1472 system.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe"C:\Users\Admin\AppData\Local\Temp\180a4a691e3ea4fc75612a05d9ea7f5507309a185f86049923f040a8ebc88e21.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\system.exe"C:\Users\Admin\AppData\Roaming\system.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\system.exe" "system.exe" ENABLE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.pngFilesize
2KB
MD5340b294efc691d1b20c64175d565ebc7
SHA181cb9649bd1c9a62ae79e781818fc24d15c29ce7
SHA25672566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9
SHA5121395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cddFilesize
13KB
MD53e7ecaeb51c2812d13b07ec852d74aaf
SHA1e9bdab93596ffb0f7f8c65243c579180939acb26
SHA256e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96
SHA512635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.datFilesize
185KB
MD596c8ab7d720ef93c062b660d69f88dd3
SHA1625c2488fac853191b24db045db1c26e93d552e5
SHA256be6d3616721f428190944b5603d06c25594fdc7499c8ef7eeabdbca2690fe457
SHA51253161392d2e9ef053ef819d48b4beb190425c535d0fe03200d3492fa4571baaca8e305b48c5316dde35710e426511be2860ab60343ea892dc738853bd3cb26a1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settingsFilesize
5B
MD568934a3e9455fa72420237eb05902327
SHA17cb6efb98ba5972a9b5090dc2e517fe14d12cb04
SHA256fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
SHA512719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllFilesize
322KB
MD5c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
C:\Users\Admin\AppData\Roaming\system.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
C:\Users\Admin\AppData\Roaming\system.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllFilesize
322KB
MD5c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
\Users\Admin\AppData\Roaming\system.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
\Users\Admin\AppData\Roaming\system.exeFilesize
185KB
MD5ee98354431c4b8933eb8f06e10738e86
SHA1fee5556f0fbea4667120598c865ee88c9a039dd1
SHA256a1456154cec24379fbc029c286104505ee3e1e5256e850c33c7e5353d5b1b7f4
SHA5127223995383df20f1190d4b5cef021013272df5df671571cd89bb63150488a57f96fdaa78c04785a023672139fc7b884d2e1caf30faee0a55e8f22ae2499c8bd1
-
memory/288-54-0x0000000075691000-0x0000000075693000-memory.dmpFilesize
8KB
-
memory/1064-56-0x0000000000000000-mapping.dmp
-
memory/1472-78-0x0000000000000000-mapping.dmp
-
memory/1472-83-0x0000000072F60000-0x000000007350B000-memory.dmpFilesize
5.7MB
-
memory/1560-84-0x0000000000000000-mapping.dmp
-
memory/1936-71-0x0000000000000000-mapping.dmp
-
memory/1936-76-0x0000000072F60000-0x000000007350B000-memory.dmpFilesize
5.7MB