Analysis
-
max time kernel
147s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 09:50
Static task
static1
Behavioral task
behavioral1
Sample
1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe
Resource
win10v2004-20220414-en
General
-
Target
1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe
-
Size
601KB
-
MD5
d9c8bd38f224c7a9708ea0699ea0411b
-
SHA1
81d7ef1b4ab40e8aecedfc0964498d023c398b56
-
SHA256
1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907
-
SHA512
8fa732f8d262911ca152b3555a2d134fe3919d105710f1c0877c60f2524113676c27910497171ca713082041480d0173064be6666ec23b93faee2ea2933f9b8a
Malware Config
Extracted
njrat
im523
HacKed
134.249.177.58:1604
262f5018bfdda234f289191972a2bad6
-
reg_key
262f5018bfdda234f289191972a2bad6
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
rascripten.exesvhost.exepid process 4980 rascripten.exe 4264 svhost.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RegAsm.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chome_exe = "C:\\Users\\Admin\\AppData\\Roaming\\vlc\\chome_exe.exe" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chome_exe = "C:\\Users\\Admin\\AppData\\Roaming\\vlc\\chome_exe.exe" powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exerascripten.exedescription pid process target process PID 4380 set thread context of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4980 set thread context of 1872 4980 rascripten.exe RegAsm.exe -
Drops file in Windows directory 3 IoCs
Processes:
RegAsm.exedescription ioc process File opened for modification C:\Windows\svhost.exe RegAsm.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe RegAsm.exe File created C:\Windows\svhost.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2228 powershell.exe 2228 powershell.exe 1932 powershell.exe 1932 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2228 powershell.exe Token: SeDebugPrivilege 1932 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exeRegAsm.exerascripten.exeRegAsm.exedescription pid process target process PID 4380 wrote to memory of 2228 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe powershell.exe PID 4380 wrote to memory of 2228 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe powershell.exe PID 4380 wrote to memory of 2228 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe powershell.exe PID 4380 wrote to memory of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4380 wrote to memory of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4380 wrote to memory of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4380 wrote to memory of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4380 wrote to memory of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4380 wrote to memory of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4380 wrote to memory of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4380 wrote to memory of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4380 wrote to memory of 4872 4380 1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe RegAsm.exe PID 4872 wrote to memory of 4980 4872 RegAsm.exe rascripten.exe PID 4872 wrote to memory of 4980 4872 RegAsm.exe rascripten.exe PID 4872 wrote to memory of 4980 4872 RegAsm.exe rascripten.exe PID 4980 wrote to memory of 1932 4980 rascripten.exe powershell.exe PID 4980 wrote to memory of 1932 4980 rascripten.exe powershell.exe PID 4980 wrote to memory of 1932 4980 rascripten.exe powershell.exe PID 4980 wrote to memory of 1872 4980 rascripten.exe RegAsm.exe PID 4980 wrote to memory of 1872 4980 rascripten.exe RegAsm.exe PID 4980 wrote to memory of 1872 4980 rascripten.exe RegAsm.exe PID 4980 wrote to memory of 1872 4980 rascripten.exe RegAsm.exe PID 4980 wrote to memory of 1872 4980 rascripten.exe RegAsm.exe PID 4980 wrote to memory of 1872 4980 rascripten.exe RegAsm.exe PID 4980 wrote to memory of 1872 4980 rascripten.exe RegAsm.exe PID 4980 wrote to memory of 1872 4980 rascripten.exe RegAsm.exe PID 1872 wrote to memory of 4264 1872 RegAsm.exe svhost.exe PID 1872 wrote to memory of 4264 1872 RegAsm.exe svhost.exe PID 1872 wrote to memory of 4264 1872 RegAsm.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe"C:\Users\Admin\AppData\Local\Temp\1f8797a5ea837b256d7ecf7e3cd1fed52fcbd765e91c93975a69e56781806907.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'chome_exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'chome_exe' -Value '"C:\Users\Admin\AppData\Roaming\vlc\chome_exe.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rascripten.exe"C:\Users\Admin\AppData\Local\Temp\rascripten.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'chome_exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'chome_exe' -Value '"C:\Users\Admin\AppData\Roaming\vlc\chome_exe.exe"' -PropertyType 'String'4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svhost.exe"C:\Windows\svhost.exe"5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD5def65711d78669d7f8e69313be4acf2e
SHA16522ebf1de09eeb981e270bd95114bc69a49cda6
SHA256aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
SHA51205b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5264046ad7b68d12c27cf77b15c6cc41e
SHA123bfd3a2dcfe1d8ce5bff7250616760932902626
SHA2565e079f4a681844d039a9c530a408decba76408f7131d086310497a7a3170b475
SHA5124f653697e24e929dbb06f0f47f8a86533d6cc4edf1bc258f255ed74f97fa06431db5695c77aa83910a032681e127e65ea5d794bc1f2338639bd70ffc5b1215db
-
C:\Users\Admin\AppData\Local\Temp\rascripten.exeFilesize
321KB
MD542ff1d9269a62e9b2e00def6b377e060
SHA1115f05436b0e0fc554478cb336bcfb298c17b065
SHA256d052a1c250cf3b6c34a905e278ddcc6a6a98fa95f7a455f61e7e32bfbcfe4770
SHA512cebb74db003d2128d549ad0f088b2fbace339afd995b3b9408cf6b678e5f5a6c5298e2c2d89e07b498b68d215f4f5ff681fa652a9f6eefd6de83c478f344e55e
-
C:\Users\Admin\AppData\Local\Temp\rascripten.exeFilesize
321KB
MD542ff1d9269a62e9b2e00def6b377e060
SHA1115f05436b0e0fc554478cb336bcfb298c17b065
SHA256d052a1c250cf3b6c34a905e278ddcc6a6a98fa95f7a455f61e7e32bfbcfe4770
SHA512cebb74db003d2128d549ad0f088b2fbace339afd995b3b9408cf6b678e5f5a6c5298e2c2d89e07b498b68d215f4f5ff681fa652a9f6eefd6de83c478f344e55e
-
C:\Users\Admin\AppData\Roaming\vlc\chome_exe.exeFilesize
321KB
MD542ff1d9269a62e9b2e00def6b377e060
SHA1115f05436b0e0fc554478cb336bcfb298c17b065
SHA256d052a1c250cf3b6c34a905e278ddcc6a6a98fa95f7a455f61e7e32bfbcfe4770
SHA512cebb74db003d2128d549ad0f088b2fbace339afd995b3b9408cf6b678e5f5a6c5298e2c2d89e07b498b68d215f4f5ff681fa652a9f6eefd6de83c478f344e55e
-
C:\Windows\svhost.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
C:\Windows\svhost.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
memory/1872-159-0x0000000000000000-mapping.dmp
-
memory/1872-163-0x00000000054F0000-0x000000000558C000-memory.dmpFilesize
624KB
-
memory/1872-160-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1932-158-0x0000000000000000-mapping.dmp
-
memory/2228-154-0x00000000072C0000-0x0000000007356000-memory.dmpFilesize
600KB
-
memory/2228-156-0x00000000067F0000-0x0000000006812000-memory.dmpFilesize
136KB
-
memory/2228-139-0x0000000002920000-0x0000000002956000-memory.dmpFilesize
216KB
-
memory/2228-146-0x0000000005B50000-0x0000000005BB6000-memory.dmpFilesize
408KB
-
memory/2228-147-0x0000000005C30000-0x0000000005C96000-memory.dmpFilesize
408KB
-
memory/2228-143-0x0000000005520000-0x0000000005B48000-memory.dmpFilesize
6.2MB
-
memory/2228-144-0x0000000005170000-0x0000000005192000-memory.dmpFilesize
136KB
-
memory/2228-136-0x0000000000000000-mapping.dmp
-
memory/2228-155-0x00000000067A0000-0x00000000067BA000-memory.dmpFilesize
104KB
-
memory/2228-153-0x00000000062E0000-0x00000000062FE000-memory.dmpFilesize
120KB
-
memory/4264-164-0x0000000000000000-mapping.dmp
-
memory/4264-167-0x0000000000450000-0x0000000000462000-memory.dmpFilesize
72KB
-
memory/4380-133-0x0000000004F60000-0x0000000004F6A000-memory.dmpFilesize
40KB
-
memory/4380-135-0x00000000052C0000-0x00000000052DE000-memory.dmpFilesize
120KB
-
memory/4380-130-0x0000000000500000-0x000000000059C000-memory.dmpFilesize
624KB
-
memory/4380-134-0x0000000005240000-0x00000000052B6000-memory.dmpFilesize
472KB
-
memory/4380-132-0x0000000004FC0000-0x0000000005052000-memory.dmpFilesize
584KB
-
memory/4380-131-0x00000000054D0000-0x0000000005A74000-memory.dmpFilesize
5.6MB
-
memory/4872-137-0x0000000000000000-mapping.dmp
-
memory/4872-141-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4872-152-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4872-145-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4872-138-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4980-148-0x0000000000000000-mapping.dmp
-
memory/4980-151-0x0000000000B00000-0x0000000000B56000-memory.dmpFilesize
344KB