Analysis

  • max time kernel
    132s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    28-03-2022 16:29

General

  • Target

    e6e87151daaf725992dd568559325789058b681d9a615ab40ad28f23ea2a63ad.exe

  • Size

    3.2MB

  • MD5

    1f4471d1fb4cf66f97b4fefb6ce5f489

  • SHA1

    f26121f7400b3284a5ba231678b8ca82f77cb0e1

  • SHA256

    e6e87151daaf725992dd568559325789058b681d9a615ab40ad28f23ea2a63ad

  • SHA512

    f57289013e805d84d78e978adfbc663d050c92bff57c53b554977892ac355bf75caf9795ffcddb09b44c16f47b10cc10a293b1cb11178b37289c14bba4db670a

Malware Config

Extracted

Family

njrat

Version

Haf4me

Botnet

zombie

C2

getrattedlol.inner574.kro.kr:666

Mutex

1553eeb1b07c73f12f12cb58bb315e07

Attributes
  • reg_key

    1553eeb1b07c73f12f12cb58bb315e07

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6e87151daaf725992dd568559325789058b681d9a615ab40ad28f23ea2a63ad.exe
    "C:\Users\Admin\AppData\Local\Temp\e6e87151daaf725992dd568559325789058b681d9a615ab40ad28f23ea2a63ad.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1460
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4212
        • C:\Windows\SysWOW64\fondue.exe
          "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:460
          • C:\Windows\system32\FonDUE.EXE
            "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
            5⤵
              PID:4016
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4a0 0x4a4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2060

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.png
      Filesize

      2KB

      MD5

      340b294efc691d1b20c64175d565ebc7

      SHA1

      81cb9649bd1c9a62ae79e781818fc24d15c29ce7

      SHA256

      72566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9

      SHA512

      1395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cdd
      Filesize

      13KB

      MD5

      3e7ecaeb51c2812d13b07ec852d74aaf

      SHA1

      e9bdab93596ffb0f7f8c65243c579180939acb26

      SHA256

      e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96

      SHA512

      635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      Filesize

      6.1MB

      MD5

      424bf196deaeb4ddcafb78e137fa560a

      SHA1

      007738e9486c904a3115daa6e8ba2ee692af58c8

      SHA256

      0963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2

      SHA512

      a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe
      Filesize

      6.1MB

      MD5

      424bf196deaeb4ddcafb78e137fa560a

      SHA1

      007738e9486c904a3115daa6e8ba2ee692af58c8

      SHA256

      0963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2

      SHA512

      a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.dat
      Filesize

      23KB

      MD5

      5b492b84c9ea7a306eb200d978849ff2

      SHA1

      0b5f5673318e44d61026abf70b6b19006ba4a176

      SHA256

      5fd8a3204931d21166802abc791bf6a7508778e674c2529d0521767d657926cc

      SHA512

      94be06a8f4b904c40f0adc8bdd6508cfb0dae9b2f08681f11002ecb9a1eb31aa9fc182b0a73fdd3342926da1d8c008e984d70de4f4f5d284bf1d1228b3d0643f

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
      Filesize

      23KB

      MD5

      7ddf4766f38f2afff31e9ba389e16356

      SHA1

      ebbf590eee2c682ca37ba7f5929920ceb0367e86

      SHA256

      690f7f4eaece0c198796dc8ab45d3920ec066667b1ade56c07254fbfd6e079a1

      SHA512

      09e59bc227faa516529f808b76604a205d0821ace41bca9cb393ca7afe1d106ebd98608b4a97858ddd48b2dce0cc348bf2e733a28ad779e9a688175ab7483af5

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe
      Filesize

      23KB

      MD5

      7ddf4766f38f2afff31e9ba389e16356

      SHA1

      ebbf590eee2c682ca37ba7f5929920ceb0367e86

      SHA256

      690f7f4eaece0c198796dc8ab45d3920ec066667b1ade56c07254fbfd6e079a1

      SHA512

      09e59bc227faa516529f808b76604a205d0821ace41bca9cb393ca7afe1d106ebd98608b4a97858ddd48b2dce0cc348bf2e733a28ad779e9a688175ab7483af5

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settings
      Filesize

      4B

      MD5

      b326b5062b2f0e69046810717534cb09

      SHA1

      5ffe533b830f08a0326348a9160afafc8ada44db

      SHA256

      b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

      SHA512

      9120cd5faef07a08e971ff024a3fcbea1e3a6b44142a6d82ca28c6c42e4f852595bcf53d81d776f10541045abdb7c37950629415d0dc66c8d86c64a5606d32de

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll
      Filesize

      322KB

      MD5

      c3256800dce47c14acc83ccca4c3e2ac

      SHA1

      9d126818c66991dbc3813a65eddb88bbcf77f30a

      SHA256

      f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866

      SHA512

      6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dll
      Filesize

      322KB

      MD5

      c3256800dce47c14acc83ccca4c3e2ac

      SHA1

      9d126818c66991dbc3813a65eddb88bbcf77f30a

      SHA256

      f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866

      SHA512

      6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25

    • memory/460-142-0x0000000000000000-mapping.dmp
    • memory/1460-130-0x0000000000000000-mapping.dmp
    • memory/4016-143-0x0000000000000000-mapping.dmp
    • memory/4212-139-0x0000000000000000-mapping.dmp