Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe
Resource
win10v2004-20220414-en
General
-
Target
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe
-
Size
212KB
-
MD5
b6fb59b629ff7361ca59bc57d44b3ffe
-
SHA1
24ffe3043b12a6db42cae02a6f46e213e3012fce
-
SHA256
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
-
SHA512
a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
Malware Config
Extracted
njrat
0.7d
Money$Bea$t
mailsdc61.ga:5490
efc8d3c97ca9383f77f8c3938dbe8fdd
-
reg_key
efc8d3c97ca9383f77f8c3938dbe8fdd
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
mp4player.exemp4player.exepid process 1168 mp4player.exe 852 mp4player.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
mp4player.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\efc8d3c97ca9383f77f8c3938dbe8fdd.exe mp4player.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\efc8d3c97ca9383f77f8c3938dbe8fdd.exe mp4player.exe -
Loads dropped DLL 2 IoCs
Processes:
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exepid process 1280 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 1280 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
mp4player.exe38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exemp4player.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\efc8d3c97ca9383f77f8c3938dbe8fdd = "\"C:\\Users\\Admin\\AppData\\Roaming\\mp4player.exe\" .." mp4player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\efc8d3c97ca9383f77f8c3938dbe8fdd = "\"C:\\Users\\Admin\\AppData\\Roaming\\mp4player.exe\" .." mp4player.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Azzure IT = "C:\\Users\\Admin\\AppData\\Roaming\\ofRGr\\delhz.exe" 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Azzure IT = "C:\\Users\\Admin\\AppData\\Roaming\\ofRGr\\delhz.exe" mp4player.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exemp4player.exedescription pid process target process PID 1880 set thread context of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1168 set thread context of 852 1168 mp4player.exe mp4player.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
mp4player.exedescription pid process Token: SeDebugPrivilege 852 mp4player.exe Token: 33 852 mp4player.exe Token: SeIncBasePriorityPrivilege 852 mp4player.exe Token: 33 852 mp4player.exe Token: SeIncBasePriorityPrivilege 852 mp4player.exe Token: 33 852 mp4player.exe Token: SeIncBasePriorityPrivilege 852 mp4player.exe Token: 33 852 mp4player.exe Token: SeIncBasePriorityPrivilege 852 mp4player.exe Token: 33 852 mp4player.exe Token: SeIncBasePriorityPrivilege 852 mp4player.exe Token: 33 852 mp4player.exe Token: SeIncBasePriorityPrivilege 852 mp4player.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exemp4player.exemp4player.exedescription pid process target process PID 1880 wrote to memory of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1880 wrote to memory of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1880 wrote to memory of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1880 wrote to memory of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1880 wrote to memory of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1880 wrote to memory of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1880 wrote to memory of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1880 wrote to memory of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1880 wrote to memory of 1280 1880 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1280 wrote to memory of 1168 1280 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe mp4player.exe PID 1280 wrote to memory of 1168 1280 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe mp4player.exe PID 1280 wrote to memory of 1168 1280 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe mp4player.exe PID 1280 wrote to memory of 1168 1280 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe mp4player.exe PID 1168 wrote to memory of 852 1168 mp4player.exe mp4player.exe PID 1168 wrote to memory of 852 1168 mp4player.exe mp4player.exe PID 1168 wrote to memory of 852 1168 mp4player.exe mp4player.exe PID 1168 wrote to memory of 852 1168 mp4player.exe mp4player.exe PID 1168 wrote to memory of 852 1168 mp4player.exe mp4player.exe PID 1168 wrote to memory of 852 1168 mp4player.exe mp4player.exe PID 1168 wrote to memory of 852 1168 mp4player.exe mp4player.exe PID 1168 wrote to memory of 852 1168 mp4player.exe mp4player.exe PID 1168 wrote to memory of 852 1168 mp4player.exe mp4player.exe PID 852 wrote to memory of 1992 852 mp4player.exe netsh.exe PID 852 wrote to memory of 1992 852 mp4player.exe netsh.exe PID 852 wrote to memory of 1992 852 mp4player.exe netsh.exe PID 852 wrote to memory of 1992 852 mp4player.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe"C:\Users\Admin\AppData\Local\Temp\38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe"C:\Users\Admin\AppData\Local\Temp\38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Roaming\mp4player.exe"C:\Users\Admin\AppData\Roaming\mp4player.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Roaming\mp4player.exe"C:\Users\Admin\AppData\Roaming\mp4player.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\mp4player.exe" "mp4player.exe" ENABLE5⤵
- Modifies Windows Firewall
PID:1992
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\mp4player.exeFilesize
212KB
MD5b6fb59b629ff7361ca59bc57d44b3ffe
SHA124ffe3043b12a6db42cae02a6f46e213e3012fce
SHA25638df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
SHA512a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
-
C:\Users\Admin\AppData\Roaming\mp4player.exeFilesize
212KB
MD5b6fb59b629ff7361ca59bc57d44b3ffe
SHA124ffe3043b12a6db42cae02a6f46e213e3012fce
SHA25638df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
SHA512a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
-
C:\Users\Admin\AppData\Roaming\mp4player.exeFilesize
212KB
MD5b6fb59b629ff7361ca59bc57d44b3ffe
SHA124ffe3043b12a6db42cae02a6f46e213e3012fce
SHA25638df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
SHA512a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
-
\Users\Admin\AppData\Roaming\mp4player.exeFilesize
212KB
MD5b6fb59b629ff7361ca59bc57d44b3ffe
SHA124ffe3043b12a6db42cae02a6f46e213e3012fce
SHA25638df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
SHA512a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
-
\Users\Admin\AppData\Roaming\mp4player.exeFilesize
212KB
MD5b6fb59b629ff7361ca59bc57d44b3ffe
SHA124ffe3043b12a6db42cae02a6f46e213e3012fce
SHA25638df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
SHA512a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
-
memory/852-95-0x00000000741E0000-0x000000007478B000-memory.dmpFilesize
5.7MB
-
memory/852-93-0x00000000741E0000-0x000000007478B000-memory.dmpFilesize
5.7MB
-
memory/852-85-0x000000000040748E-mapping.dmp
-
memory/1168-92-0x00000000741E0000-0x000000007478B000-memory.dmpFilesize
5.7MB
-
memory/1168-78-0x00000000741E0000-0x000000007478B000-memory.dmpFilesize
5.7MB
-
memory/1168-73-0x0000000000000000-mapping.dmp
-
memory/1280-70-0x00000000741E0000-0x000000007478B000-memory.dmpFilesize
5.7MB
-
memory/1280-77-0x00000000741E0000-0x000000007478B000-memory.dmpFilesize
5.7MB
-
memory/1280-69-0x00000000741E0000-0x000000007478B000-memory.dmpFilesize
5.7MB
-
memory/1280-64-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1280-66-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1280-56-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1280-62-0x000000000040748E-mapping.dmp
-
memory/1280-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1280-61-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1280-60-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1280-59-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1880-54-0x0000000075A61000-0x0000000075A63000-memory.dmpFilesize
8KB
-
memory/1880-67-0x00000000741E0000-0x000000007478B000-memory.dmpFilesize
5.7MB
-
memory/1880-55-0x00000000741E0000-0x000000007478B000-memory.dmpFilesize
5.7MB
-
memory/1992-94-0x0000000000000000-mapping.dmp