Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 18:23
Behavioral task
behavioral1
Sample
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe
Resource
win10v2004-20220414-en
General
-
Target
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe
-
Size
37KB
-
MD5
f1ea4cab8e7dd69fbe0c1da59af89b91
-
SHA1
3d0786e1b992d697ee68d802d0f7cd79c86f1218
-
SHA256
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46
-
SHA512
6aed9ec70ff1953083895cee68d2b49c590e6d85b31b3e3d608650f33455dc3e4b9e8401bba2dc97739498cbfc2a8aa49999ef589f5b2da925fde98d4efd6d67
Malware Config
Extracted
njrat
im523
HacKed
134.249.177.58:1604
c63beb330f10178c51fbfc0f300e7ec2
-
reg_key
c63beb330f10178c51fbfc0f300e7ec2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
lox.exepid process 1100 lox.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
lox.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c63beb330f10178c51fbfc0f300e7ec2.exe lox.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c63beb330f10178c51fbfc0f300e7ec2.exe lox.exe -
Loads dropped DLL 1 IoCs
Processes:
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exepid process 732 8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
lox.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\c63beb330f10178c51fbfc0f300e7ec2 = "\"C:\\Users\\Admin\\lox.exe\" .." lox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c63beb330f10178c51fbfc0f300e7ec2 = "\"C:\\Users\\Admin\\lox.exe\" .." lox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1752 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
lox.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1100 lox.exe Token: SeDebugPrivilege 1752 taskkill.exe Token: 33 1100 lox.exe Token: SeIncBasePriorityPrivilege 1100 lox.exe Token: 33 1100 lox.exe Token: SeIncBasePriorityPrivilege 1100 lox.exe Token: 33 1100 lox.exe Token: SeIncBasePriorityPrivilege 1100 lox.exe Token: 33 1100 lox.exe Token: SeIncBasePriorityPrivilege 1100 lox.exe Token: 33 1100 lox.exe Token: SeIncBasePriorityPrivilege 1100 lox.exe Token: 33 1100 lox.exe Token: SeIncBasePriorityPrivilege 1100 lox.exe Token: 33 1100 lox.exe Token: SeIncBasePriorityPrivilege 1100 lox.exe Token: 33 1100 lox.exe Token: SeIncBasePriorityPrivilege 1100 lox.exe Token: 33 1100 lox.exe Token: SeIncBasePriorityPrivilege 1100 lox.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exelox.exedescription pid process target process PID 732 wrote to memory of 1100 732 8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe lox.exe PID 732 wrote to memory of 1100 732 8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe lox.exe PID 732 wrote to memory of 1100 732 8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe lox.exe PID 732 wrote to memory of 1100 732 8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe lox.exe PID 1100 wrote to memory of 1772 1100 lox.exe netsh.exe PID 1100 wrote to memory of 1772 1100 lox.exe netsh.exe PID 1100 wrote to memory of 1772 1100 lox.exe netsh.exe PID 1100 wrote to memory of 1772 1100 lox.exe netsh.exe PID 1100 wrote to memory of 1752 1100 lox.exe taskkill.exe PID 1100 wrote to memory of 1752 1100 lox.exe taskkill.exe PID 1100 wrote to memory of 1752 1100 lox.exe taskkill.exe PID 1100 wrote to memory of 1752 1100 lox.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe"C:\Users\Admin\AppData\Local\Temp\8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\lox.exe"C:\Users\Admin\lox.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\lox.exe" "lox.exe" ENABLE3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Avast.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\lox.exeFilesize
37KB
MD5f1ea4cab8e7dd69fbe0c1da59af89b91
SHA13d0786e1b992d697ee68d802d0f7cd79c86f1218
SHA2568ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46
SHA5126aed9ec70ff1953083895cee68d2b49c590e6d85b31b3e3d608650f33455dc3e4b9e8401bba2dc97739498cbfc2a8aa49999ef589f5b2da925fde98d4efd6d67
-
C:\Users\Admin\lox.exeFilesize
37KB
MD5f1ea4cab8e7dd69fbe0c1da59af89b91
SHA13d0786e1b992d697ee68d802d0f7cd79c86f1218
SHA2568ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46
SHA5126aed9ec70ff1953083895cee68d2b49c590e6d85b31b3e3d608650f33455dc3e4b9e8401bba2dc97739498cbfc2a8aa49999ef589f5b2da925fde98d4efd6d67
-
\Users\Admin\lox.exeFilesize
37KB
MD5f1ea4cab8e7dd69fbe0c1da59af89b91
SHA13d0786e1b992d697ee68d802d0f7cd79c86f1218
SHA2568ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46
SHA5126aed9ec70ff1953083895cee68d2b49c590e6d85b31b3e3d608650f33455dc3e4b9e8401bba2dc97739498cbfc2a8aa49999ef589f5b2da925fde98d4efd6d67
-
memory/732-54-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/732-55-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1100-57-0x0000000000000000-mapping.dmp
-
memory/1100-61-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1752-63-0x0000000000000000-mapping.dmp
-
memory/1772-62-0x0000000000000000-mapping.dmp