Resubmissions
06-11-2022 13:35
221106-qvmdcafgbj 10Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 13:35
Behavioral task
behavioral1
Sample
KeyOneA.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
KeyOneA.exe
Resource
win10v2004-20220901-en
General
-
Target
KeyOneA.exe
-
Size
82KB
-
MD5
d8191eee2d99a00cb664d100ffc73b9c
-
SHA1
0063ae1d0f02d444c69a358c925e39bd542c2ee7
-
SHA256
78393fd5184de1db0bfadf7d9f345df7eeebe0249a2c57fe315812331dc76fbe
-
SHA512
e753246baebb0d57b279b0c93d06769e3c50fd49ef3e447a6278360282e2e3c884f3a97bb7cf549292c79fee99834b3d5fda8ca0ad8ed470b2255a0ce2d1f60f
-
SSDEEP
768:fE0DwODZX8f4QsFQcrM+rMRa8Nu3HtgC1GdeVtCRGYwxYIoE38KpVTdHBMNHMLa+:fhTZMAQsOv+gRJNc4/
Malware Config
Extracted
njrat
im523
HAXPC
enderop44-36084.portmap.host:36084
448265b61222a7ad1d7b5df51a023e9c
-
reg_key
448265b61222a7ad1d7b5df51a023e9c
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
DriveHost.exepid process 892 DriveHost.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
DriveHost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\448265b61222a7ad1d7b5df51a023e9c.exe DriveHost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\448265b61222a7ad1d7b5df51a023e9c.exe DriveHost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
DriveHost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\448265b61222a7ad1d7b5df51a023e9c = "\"C:\\Windows\\DriveHost.exe\" .." DriveHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\448265b61222a7ad1d7b5df51a023e9c = "\"C:\\Windows\\DriveHost.exe\" .." DriveHost.exe -
Drops file in Windows directory 3 IoCs
Processes:
KeyOneA.exeDriveHost.exedescription ioc process File created C:\Windows\DriveHost.exe KeyOneA.exe File opened for modification C:\Windows\DriveHost.exe KeyOneA.exe File opened for modification C:\Windows\DriveHost.exe DriveHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
DriveHost.exepid process 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe 892 DriveHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
DriveHost.exepid process 892 DriveHost.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
DriveHost.exedescription pid process Token: SeDebugPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe Token: 33 892 DriveHost.exe Token: SeIncBasePriorityPrivilege 892 DriveHost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
KeyOneA.exeDriveHost.exedescription pid process target process PID 1604 wrote to memory of 892 1604 KeyOneA.exe DriveHost.exe PID 1604 wrote to memory of 892 1604 KeyOneA.exe DriveHost.exe PID 1604 wrote to memory of 892 1604 KeyOneA.exe DriveHost.exe PID 1604 wrote to memory of 892 1604 KeyOneA.exe DriveHost.exe PID 892 wrote to memory of 520 892 DriveHost.exe netsh.exe PID 892 wrote to memory of 520 892 DriveHost.exe netsh.exe PID 892 wrote to memory of 520 892 DriveHost.exe netsh.exe PID 892 wrote to memory of 520 892 DriveHost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KeyOneA.exe"C:\Users\Admin\AppData\Local\Temp\KeyOneA.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\DriveHost.exe"C:\Windows\DriveHost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\DriveHost.exe" "DriveHost.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\DriveHost.exeFilesize
82KB
MD5d8191eee2d99a00cb664d100ffc73b9c
SHA10063ae1d0f02d444c69a358c925e39bd542c2ee7
SHA25678393fd5184de1db0bfadf7d9f345df7eeebe0249a2c57fe315812331dc76fbe
SHA512e753246baebb0d57b279b0c93d06769e3c50fd49ef3e447a6278360282e2e3c884f3a97bb7cf549292c79fee99834b3d5fda8ca0ad8ed470b2255a0ce2d1f60f
-
C:\Windows\DriveHost.exeFilesize
82KB
MD5d8191eee2d99a00cb664d100ffc73b9c
SHA10063ae1d0f02d444c69a358c925e39bd542c2ee7
SHA25678393fd5184de1db0bfadf7d9f345df7eeebe0249a2c57fe315812331dc76fbe
SHA512e753246baebb0d57b279b0c93d06769e3c50fd49ef3e447a6278360282e2e3c884f3a97bb7cf549292c79fee99834b3d5fda8ca0ad8ed470b2255a0ce2d1f60f
-
memory/520-62-0x0000000000000000-mapping.dmp
-
memory/892-56-0x0000000000000000-mapping.dmp
-
memory/892-61-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB
-
memory/892-64-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB
-
memory/1604-54-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/1604-55-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB
-
memory/1604-60-0x0000000074440000-0x00000000749EB000-memory.dmpFilesize
5.7MB