Analysis
- max time kernel
152s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
10/07/2022, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
00fb790999d31006cb8506e2d067fc3e.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
00fb790999d31006cb8506e2d067fc3e.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 00fb790999d31006cb8506e2d067fc3e.exe
- Size 2.5MB
- Sample220710-h6m51sdaa7
- SHA256 50a0f7a4caa6bf6e5763e7d102ca2755ba37e8047d97a3bd9986c8f5b02e78da
- MD5 00fb790999d31006cb8506e2d067fc3e
- SHA1 13d3ddb0522ee0d3b378a4d57a047699a0336d5e
- SHA512 3791115e4e928cf5819bab809ef918134d00607abed3fca69a42152703e30b61ad7bf18014b8514a70ae6186fe8caf2b9a433dbca078383645050f7af6a4a1cd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
PointBlank
C2
-
ajxpadrin.ddns.net:27010
Mutex
-
c245d1bf714df928920e13f7565dcff6
Attributes
-
reg_key
c245d1bf714df928920e13f7565dcff6
-
splitter
|'|'|
Signatures
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
- Executes dropped EXE 3 IoCs
pid Process 4420 diamondupdate.exe 3148 Diamond Loader.exe 3500 taskhost.exe - Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1328 netsh.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 00fb790999d31006cb8506e2d067fc3e.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation diamondupdate.exe - Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c245d1bf714df928920e13f7565dcff6.exe taskhost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c245d1bf714df928920e13f7565dcff6.exe taskhost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c245d1bf714df928920e13f7565dcff6 = "\"C:\\Windows\\taskhost.exe\" .." taskhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c245d1bf714df928920e13f7565dcff6 = "\"C:\\Windows\\taskhost.exe\" .." taskhost.exe - Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created D:\autorun.inf taskhost.exe File created C:\autorun.inf taskhost.exe File opened for modification C:\autorun.inf taskhost.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Diamond Loader.exe 00fb790999d31006cb8506e2d067fc3e.exe File opened for modification C:\Windows\Diamond Loader.exe Diamond Loader.exe File opened for modification C:\Windows\diamondupdate.exe diamondupdate.exe File created C:\Windows\__tmp_rar_sfx_access_check_240582578 00fb790999d31006cb8506e2d067fc3e.exe File opened for modification C:\Windows\Diamond Loader.exe 00fb790999d31006cb8506e2d067fc3e.exe File created C:\Windows\diamondupdate.exe 00fb790999d31006cb8506e2d067fc3e.exe File opened for modification C:\Windows\diamondupdate.exe 00fb790999d31006cb8506e2d067fc3e.exe File created C:\Windows\taskhost.exe diamondupdate.exe File opened for modification C:\Windows\taskhost.exe diamondupdate.exe File opened for modification C:\Windows\taskhost.exe taskhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe 3500 taskhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3500 taskhost.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe Token: 33 3500 taskhost.exe Token: SeIncBasePriorityPrivilege 3500 taskhost.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3148 Diamond Loader.exe 3148 Diamond Loader.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 532 wrote to memory of 4420 532 00fb790999d31006cb8506e2d067fc3e.exe 82 PID 532 wrote to memory of 4420 532 00fb790999d31006cb8506e2d067fc3e.exe 82 PID 532 wrote to memory of 4420 532 00fb790999d31006cb8506e2d067fc3e.exe 82 PID 532 wrote to memory of 3148 532 00fb790999d31006cb8506e2d067fc3e.exe 84 PID 532 wrote to memory of 3148 532 00fb790999d31006cb8506e2d067fc3e.exe 84 PID 532 wrote to memory of 3148 532 00fb790999d31006cb8506e2d067fc3e.exe 84 PID 4420 wrote to memory of 3500 4420 diamondupdate.exe 85 PID 4420 wrote to memory of 3500 4420 diamondupdate.exe 85 PID 4420 wrote to memory of 3500 4420 diamondupdate.exe 85 PID 3500 wrote to memory of 1328 3500 taskhost.exe 89 PID 3500 wrote to memory of 1328 3500 taskhost.exe 89 PID 3500 wrote to memory of 1328 3500 taskhost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\00fb790999d31006cb8506e2d067fc3e.exe"C:\Users\Admin\AppData\Local\Temp\00fb790999d31006cb8506e2d067fc3e.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\diamondupdate.exe"C:\Windows\diamondupdate.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\taskhost.exe"C:\Windows\taskhost.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\taskhost.exe" "taskhost.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:1328
-
-
-
-
C:\Windows\Diamond Loader.exe"C:\Windows\Diamond Loader.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3148
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Diamond Loader.exe
- Size 7.8MB
- SHA256 d5101fa11b06c90b7c9ea17cb987f9f649397fe27bc57344ec2feaaba7da271f
- MD5 d7ca001847a91c0cc128befb5eced995
- SHA1 35b86735963345c2f12f7dda443f4681480c458d
- SHA512 44ef6c87db24af81050bbc20d4bb9ee29d9d190edea315a77fe1235d6d506f2e3307f748649880a3d8d3e7e00781df8543dca72fe5449e4923176dda971c4042
- SSDEEP 98304:XY9plKAKIMaFnrr+CxCSglqJyJ1MgLVX7yhSK:XsWARMOHAqYJSd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Diamond Loader.exe
- Size 7.8MB
- SHA256 d5101fa11b06c90b7c9ea17cb987f9f649397fe27bc57344ec2feaaba7da271f
- MD5 d7ca001847a91c0cc128befb5eced995
- SHA1 35b86735963345c2f12f7dda443f4681480c458d
- SHA512 44ef6c87db24af81050bbc20d4bb9ee29d9d190edea315a77fe1235d6d506f2e3307f748649880a3d8d3e7e00781df8543dca72fe5449e4923176dda971c4042
- SSDEEP 98304:XY9plKAKIMaFnrr+CxCSglqJyJ1MgLVX7yhSK:XsWARMOHAqYJSd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\diamondupdate.exe
- Size 37KB
- SHA256 6ae3f2a21f14e9d1d088949a4851cb7a0ffb7b75c60637f9f7a43d3395a3dd75
- MD5 ed0912819b83b74d29c51d69caff0a20
- SHA1 3d92b8e1eaf839ac0efba3e504a301a54b8928e3
- SHA512 0f7e5fdce496a09b1cb16a221f131798f45c4acd2dc91c51ef9df8f1e2d3285eb6f7ef2593a2a80c990d10c9dff2bd11b5c8fd4e91d3435f081f6e18c1f93d51
- SSDEEP 384:/LNjkXgib5jpPu7w9qyMTGtPRwsG2DBCrAF+rMRTyN/0L+EcoinblneHQM3epzXF:xINN9ZMTGtmF2ErM+rMRa8NuQwt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\diamondupdate.exe
- Size 37KB
- SHA256 6ae3f2a21f14e9d1d088949a4851cb7a0ffb7b75c60637f9f7a43d3395a3dd75
- MD5 ed0912819b83b74d29c51d69caff0a20
- SHA1 3d92b8e1eaf839ac0efba3e504a301a54b8928e3
- SHA512 0f7e5fdce496a09b1cb16a221f131798f45c4acd2dc91c51ef9df8f1e2d3285eb6f7ef2593a2a80c990d10c9dff2bd11b5c8fd4e91d3435f081f6e18c1f93d51
- SSDEEP 384:/LNjkXgib5jpPu7w9qyMTGtPRwsG2DBCrAF+rMRTyN/0L+EcoinblneHQM3epzXF:xINN9ZMTGtmF2ErM+rMRa8NuQwt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\taskhost.exe
- Size 37KB
- SHA256 6ae3f2a21f14e9d1d088949a4851cb7a0ffb7b75c60637f9f7a43d3395a3dd75
- MD5 ed0912819b83b74d29c51d69caff0a20
- SHA1 3d92b8e1eaf839ac0efba3e504a301a54b8928e3
- SHA512 0f7e5fdce496a09b1cb16a221f131798f45c4acd2dc91c51ef9df8f1e2d3285eb6f7ef2593a2a80c990d10c9dff2bd11b5c8fd4e91d3435f081f6e18c1f93d51
- SSDEEP 384:/LNjkXgib5jpPu7w9qyMTGtPRwsG2DBCrAF+rMRTyN/0L+EcoinblneHQM3epzXF:xINN9ZMTGtmF2ErM+rMRa8NuQwt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\taskhost.exe
- Size 37KB
- SHA256 6ae3f2a21f14e9d1d088949a4851cb7a0ffb7b75c60637f9f7a43d3395a3dd75
- MD5 ed0912819b83b74d29c51d69caff0a20
- SHA1 3d92b8e1eaf839ac0efba3e504a301a54b8928e3
- SHA512 0f7e5fdce496a09b1cb16a221f131798f45c4acd2dc91c51ef9df8f1e2d3285eb6f7ef2593a2a80c990d10c9dff2bd11b5c8fd4e91d3435f081f6e18c1f93d51
- SSDEEP 384:/LNjkXgib5jpPu7w9qyMTGtPRwsG2DBCrAF+rMRTyN/0L+EcoinblneHQM3epzXF:xINN9ZMTGtmF2ErM+rMRa8NuQwt
- MD5 SHA1 SHA512 SSDEEP