Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe
Resource
win10v2004-20220414-en
General
-
Target
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe
-
Size
212KB
-
MD5
b6fb59b629ff7361ca59bc57d44b3ffe
-
SHA1
24ffe3043b12a6db42cae02a6f46e213e3012fce
-
SHA256
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
-
SHA512
a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
Malware Config
Extracted
njrat
0.7d
Money$Bea$t
mailsdc61.ga:5490
efc8d3c97ca9383f77f8c3938dbe8fdd
-
reg_key
efc8d3c97ca9383f77f8c3938dbe8fdd
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
mp4player.exemp4player.exepid process 4504 mp4player.exe 2648 mp4player.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe -
Drops startup file 2 IoCs
Processes:
mp4player.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\efc8d3c97ca9383f77f8c3938dbe8fdd.exe mp4player.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\efc8d3c97ca9383f77f8c3938dbe8fdd.exe mp4player.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exemp4player.exemp4player.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Azzure IT = "C:\\Users\\Admin\\AppData\\Roaming\\ofRGr\\delhz.exe" 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Azzure IT = "C:\\Users\\Admin\\AppData\\Roaming\\ofRGr\\delhz.exe" mp4player.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\efc8d3c97ca9383f77f8c3938dbe8fdd = "\"C:\\Users\\Admin\\AppData\\Roaming\\mp4player.exe\" .." mp4player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\efc8d3c97ca9383f77f8c3938dbe8fdd = "\"C:\\Users\\Admin\\AppData\\Roaming\\mp4player.exe\" .." mp4player.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exemp4player.exedescription pid process target process PID 1412 set thread context of 4160 1412 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 4504 set thread context of 2648 4504 mp4player.exe mp4player.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
mp4player.exedescription pid process Token: SeDebugPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe Token: 33 2648 mp4player.exe Token: SeIncBasePriorityPrivilege 2648 mp4player.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exemp4player.exemp4player.exedescription pid process target process PID 1412 wrote to memory of 4160 1412 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1412 wrote to memory of 4160 1412 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1412 wrote to memory of 4160 1412 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1412 wrote to memory of 4160 1412 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1412 wrote to memory of 4160 1412 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1412 wrote to memory of 4160 1412 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1412 wrote to memory of 4160 1412 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 1412 wrote to memory of 4160 1412 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe PID 4160 wrote to memory of 4504 4160 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe mp4player.exe PID 4160 wrote to memory of 4504 4160 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe mp4player.exe PID 4160 wrote to memory of 4504 4160 38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe mp4player.exe PID 4504 wrote to memory of 2648 4504 mp4player.exe mp4player.exe PID 4504 wrote to memory of 2648 4504 mp4player.exe mp4player.exe PID 4504 wrote to memory of 2648 4504 mp4player.exe mp4player.exe PID 4504 wrote to memory of 2648 4504 mp4player.exe mp4player.exe PID 4504 wrote to memory of 2648 4504 mp4player.exe mp4player.exe PID 4504 wrote to memory of 2648 4504 mp4player.exe mp4player.exe PID 4504 wrote to memory of 2648 4504 mp4player.exe mp4player.exe PID 4504 wrote to memory of 2648 4504 mp4player.exe mp4player.exe PID 2648 wrote to memory of 1532 2648 mp4player.exe netsh.exe PID 2648 wrote to memory of 1532 2648 mp4player.exe netsh.exe PID 2648 wrote to memory of 1532 2648 mp4player.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe"C:\Users\Admin\AppData\Local\Temp\38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe"C:\Users\Admin\AppData\Local\Temp\38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mp4player.exe"C:\Users\Admin\AppData\Roaming\mp4player.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mp4player.exe"C:\Users\Admin\AppData\Roaming\mp4player.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\mp4player.exe" "mp4player.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\38df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5.exe.logFilesize
313B
MD500b72ea3d569eb0d4fb85691b642f47c
SHA1f9134a33706eb76ddb00e5276639d660a071da9b
SHA256cd62d4fbf8b135be5c0b8448a7d53db7784869761a10ec99473f58f44d8e686c
SHA51262af7608834d84fa95470247cab4bfa5a382825f81e9918b762e62dfc6c467e7b50cfb5b2fd36eff1da320e22aa8c1427c02820e06d9f2f6483e64740a43e8df
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\mp4player.exe.logFilesize
313B
MD500b72ea3d569eb0d4fb85691b642f47c
SHA1f9134a33706eb76ddb00e5276639d660a071da9b
SHA256cd62d4fbf8b135be5c0b8448a7d53db7784869761a10ec99473f58f44d8e686c
SHA51262af7608834d84fa95470247cab4bfa5a382825f81e9918b762e62dfc6c467e7b50cfb5b2fd36eff1da320e22aa8c1427c02820e06d9f2f6483e64740a43e8df
-
C:\Users\Admin\AppData\Roaming\mp4player.exeFilesize
212KB
MD5b6fb59b629ff7361ca59bc57d44b3ffe
SHA124ffe3043b12a6db42cae02a6f46e213e3012fce
SHA25638df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
SHA512a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
-
C:\Users\Admin\AppData\Roaming\mp4player.exeFilesize
212KB
MD5b6fb59b629ff7361ca59bc57d44b3ffe
SHA124ffe3043b12a6db42cae02a6f46e213e3012fce
SHA25638df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
SHA512a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
-
C:\Users\Admin\AppData\Roaming\mp4player.exeFilesize
212KB
MD5b6fb59b629ff7361ca59bc57d44b3ffe
SHA124ffe3043b12a6db42cae02a6f46e213e3012fce
SHA25638df39b8f59e65ddfc8558b554ed8449815e2a1da263911f5fa5adc610101ae5
SHA512a6b9c88f3caa11e255a7f13fb4eb59d3668e6814e86aa5b8f97a86728a856d8e748561ea717add208ab7cd1af438ae88c7959b856c54da0f67cb725e26319dec
-
memory/1412-134-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/1412-130-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/1532-147-0x0000000000000000-mapping.dmp
-
memory/2648-141-0x0000000000000000-mapping.dmp
-
memory/2648-148-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/2648-146-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/4160-132-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4160-131-0x0000000000000000-mapping.dmp
-
memory/4160-139-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/4160-135-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/4504-140-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/4504-145-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/4504-136-0x0000000000000000-mapping.dmp