Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 18:23
Behavioral task
behavioral1
Sample
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe
Resource
win10v2004-20220414-en
General
-
Target
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe
-
Size
37KB
-
MD5
f1ea4cab8e7dd69fbe0c1da59af89b91
-
SHA1
3d0786e1b992d697ee68d802d0f7cd79c86f1218
-
SHA256
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46
-
SHA512
6aed9ec70ff1953083895cee68d2b49c590e6d85b31b3e3d608650f33455dc3e4b9e8401bba2dc97739498cbfc2a8aa49999ef589f5b2da925fde98d4efd6d67
Malware Config
Extracted
njrat
im523
HacKed
134.249.177.58:1604
c63beb330f10178c51fbfc0f300e7ec2
-
reg_key
c63beb330f10178c51fbfc0f300e7ec2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
lox.exepid process 4132 lox.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe -
Drops startup file 2 IoCs
Processes:
lox.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c63beb330f10178c51fbfc0f300e7ec2.exe lox.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c63beb330f10178c51fbfc0f300e7ec2.exe lox.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
lox.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c63beb330f10178c51fbfc0f300e7ec2 = "\"C:\\Users\\Admin\\lox.exe\" .." lox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c63beb330f10178c51fbfc0f300e7ec2 = "\"C:\\Users\\Admin\\lox.exe\" .." lox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2820 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
lox.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4132 lox.exe Token: SeDebugPrivilege 2820 taskkill.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe Token: 33 4132 lox.exe Token: SeIncBasePriorityPrivilege 4132 lox.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exelox.exedescription pid process target process PID 1056 wrote to memory of 4132 1056 8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe lox.exe PID 1056 wrote to memory of 4132 1056 8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe lox.exe PID 1056 wrote to memory of 4132 1056 8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe lox.exe PID 4132 wrote to memory of 1280 4132 lox.exe netsh.exe PID 4132 wrote to memory of 1280 4132 lox.exe netsh.exe PID 4132 wrote to memory of 1280 4132 lox.exe netsh.exe PID 4132 wrote to memory of 2820 4132 lox.exe taskkill.exe PID 4132 wrote to memory of 2820 4132 lox.exe taskkill.exe PID 4132 wrote to memory of 2820 4132 lox.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe"C:\Users\Admin\AppData\Local\Temp\8ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\lox.exe"C:\Users\Admin\lox.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\lox.exe" "lox.exe" ENABLE3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Avast.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\lox.exeFilesize
37KB
MD5f1ea4cab8e7dd69fbe0c1da59af89b91
SHA13d0786e1b992d697ee68d802d0f7cd79c86f1218
SHA2568ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46
SHA5126aed9ec70ff1953083895cee68d2b49c590e6d85b31b3e3d608650f33455dc3e4b9e8401bba2dc97739498cbfc2a8aa49999ef589f5b2da925fde98d4efd6d67
-
C:\Users\Admin\lox.exeFilesize
37KB
MD5f1ea4cab8e7dd69fbe0c1da59af89b91
SHA13d0786e1b992d697ee68d802d0f7cd79c86f1218
SHA2568ff239af6d8b798d47de9cbca70daa8f464ee3a27b16217659d7f3c96b51fc46
SHA5126aed9ec70ff1953083895cee68d2b49c590e6d85b31b3e3d608650f33455dc3e4b9e8401bba2dc97739498cbfc2a8aa49999ef589f5b2da925fde98d4efd6d67
-
memory/1056-130-0x0000000074BC0000-0x0000000075171000-memory.dmpFilesize
5.7MB
-
memory/1280-135-0x0000000000000000-mapping.dmp
-
memory/2820-136-0x0000000000000000-mapping.dmp
-
memory/4132-131-0x0000000000000000-mapping.dmp
-
memory/4132-134-0x0000000074BC0000-0x0000000075171000-memory.dmpFilesize
5.7MB