Analysis
-
max time kernel
188s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:48
Static task
static1
Behavioral task
behavioral1
Sample
84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe
Resource
win10v2004-20221111-en
General
-
Target
84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe
-
Size
565KB
-
MD5
2f1e49abe8fbe294a68fc7fcef290e96
-
SHA1
2afac2bafa7a488d9c0a9bd3e11af0a24156bc5e
-
SHA256
84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4
-
SHA512
e02903f3780f0bb593f74822e611717e727f723bcdde499dfc5cd76fb4a099c15a3de31a6a52465f92f6bf757b0a21734a4bf0260bb7a43bc92c1e5ea84c8efa
-
SSDEEP
6144:ePbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9xHbp:2QtqB5urTIoYWBQk1E+VF9mOx9xp
Malware Config
Extracted
njrat
0.7d
HacKed
steam.user32.com:5552
51aa7e07f3bb4f632f1f0fc8c30d101f
-
reg_key
51aa7e07f3bb4f632f1f0fc8c30d101f
-
splitter
|'|'|
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1692-63-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1692-64-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1692-68-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1692-78-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1692-85-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
Nirsoft 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1692-63-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1692-64-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1692-68-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1692-78-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1692-85-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
EBFile_1.exeflash.exepid process 1484 EBFile_1.exe 1812 flash.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
Processes:
84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exeEBFile_1.exepid process 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe 1484 EBFile_1.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
flash.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\51aa7e07f3bb4f632f1f0fc8c30d101f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\flash.exe\" .." flash.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\51aa7e07f3bb4f632f1f0fc8c30d101f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\flash.exe\" .." flash.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exedescription pid process target process PID 872 set thread context of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 set thread context of 1720 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exeflash.exedescription pid process Token: SeDebugPrivilege 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe Token: SeDebugPrivilege 1812 flash.exe Token: 33 1812 flash.exe Token: SeIncBasePriorityPrivilege 1812 flash.exe Token: 33 1812 flash.exe Token: SeIncBasePriorityPrivilege 1812 flash.exe Token: 33 1812 flash.exe Token: SeIncBasePriorityPrivilege 1812 flash.exe Token: 33 1812 flash.exe Token: SeIncBasePriorityPrivilege 1812 flash.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exepid process 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exeEBFile_1.exeflash.exedescription pid process target process PID 872 wrote to memory of 1484 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe EBFile_1.exe PID 872 wrote to memory of 1484 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe EBFile_1.exe PID 872 wrote to memory of 1484 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe EBFile_1.exe PID 872 wrote to memory of 1484 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe EBFile_1.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1692 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1720 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1720 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1720 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1720 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1720 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 872 wrote to memory of 1720 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe vbc.exe PID 1484 wrote to memory of 1812 1484 EBFile_1.exe flash.exe PID 1484 wrote to memory of 1812 1484 EBFile_1.exe flash.exe PID 1484 wrote to memory of 1812 1484 EBFile_1.exe flash.exe PID 1484 wrote to memory of 1812 1484 EBFile_1.exe flash.exe PID 872 wrote to memory of 1772 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe dw20.exe PID 872 wrote to memory of 1772 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe dw20.exe PID 872 wrote to memory of 1772 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe dw20.exe PID 872 wrote to memory of 1772 872 84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe dw20.exe PID 1812 wrote to memory of 936 1812 flash.exe netsh.exe PID 1812 wrote to memory of 936 1812 flash.exe netsh.exe PID 1812 wrote to memory of 936 1812 flash.exe netsh.exe PID 1812 wrote to memory of 936 1812 flash.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe"C:\Users\Admin\AppData\Local\Temp\84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe"C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\flash.exe"C:\Users\Admin\AppData\Local\Temp\flash.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\flash.exe" "flash.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:936 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"2⤵
- Accesses Microsoft Outlook accounts
PID:1692 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"2⤵PID:1720
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8762⤵PID:1772
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD5306619a083ed8be2118ba9ac5c38a1ba
SHA1d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b
SHA25626a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379
SHA512b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f
-
Filesize
23KB
MD5306619a083ed8be2118ba9ac5c38a1ba
SHA1d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b
SHA25626a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379
SHA512b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f
-
Filesize
23KB
MD5306619a083ed8be2118ba9ac5c38a1ba
SHA1d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b
SHA25626a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379
SHA512b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f
-
Filesize
23KB
MD5306619a083ed8be2118ba9ac5c38a1ba
SHA1d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b
SHA25626a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379
SHA512b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f
-
Filesize
23KB
MD5306619a083ed8be2118ba9ac5c38a1ba
SHA1d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b
SHA25626a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379
SHA512b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f
-
Filesize
23KB
MD5306619a083ed8be2118ba9ac5c38a1ba
SHA1d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b
SHA25626a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379
SHA512b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f