Analysis

  • max time kernel
    188s
  • max time network
    184s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 13:48

General

  • Target

    84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe

  • Size

    565KB

  • MD5

    2f1e49abe8fbe294a68fc7fcef290e96

  • SHA1

    2afac2bafa7a488d9c0a9bd3e11af0a24156bc5e

  • SHA256

    84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4

  • SHA512

    e02903f3780f0bb593f74822e611717e727f723bcdde499dfc5cd76fb4a099c15a3de31a6a52465f92f6bf757b0a21734a4bf0260bb7a43bc92c1e5ea84c8efa

  • SSDEEP

    6144:ePbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9xHbp:2QtqB5urTIoYWBQk1E+VF9mOx9xp

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

steam.user32.com:5552

Mutex

51aa7e07f3bb4f632f1f0fc8c30d101f

Attributes
  • reg_key

    51aa7e07f3bb4f632f1f0fc8c30d101f

  • splitter

    |'|'|

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • NirSoft MailPassView 5 IoCs

    Password recovery tool for various email clients

  • Nirsoft 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe
    "C:\Users\Admin\AppData\Local\Temp\84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:872
    • C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe
      "C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Users\Admin\AppData\Local\Temp\flash.exe
        "C:\Users\Admin\AppData\Local\Temp\flash.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\flash.exe" "flash.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          PID:936
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:1692
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
      2⤵
        PID:1720
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 876
        2⤵
          PID:1772

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

        Filesize

        23KB

        MD5

        306619a083ed8be2118ba9ac5c38a1ba

        SHA1

        d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b

        SHA256

        26a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379

        SHA512

        b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f

      • C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

        Filesize

        23KB

        MD5

        306619a083ed8be2118ba9ac5c38a1ba

        SHA1

        d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b

        SHA256

        26a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379

        SHA512

        b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f

      • C:\Users\Admin\AppData\Local\Temp\flash.exe

        Filesize

        23KB

        MD5

        306619a083ed8be2118ba9ac5c38a1ba

        SHA1

        d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b

        SHA256

        26a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379

        SHA512

        b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f

      • C:\Users\Admin\AppData\Local\Temp\flash.exe

        Filesize

        23KB

        MD5

        306619a083ed8be2118ba9ac5c38a1ba

        SHA1

        d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b

        SHA256

        26a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379

        SHA512

        b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f

      • \Users\Admin\AppData\Local\Temp\EBFile_1.exe

        Filesize

        23KB

        MD5

        306619a083ed8be2118ba9ac5c38a1ba

        SHA1

        d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b

        SHA256

        26a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379

        SHA512

        b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f

      • \Users\Admin\AppData\Local\Temp\flash.exe

        Filesize

        23KB

        MD5

        306619a083ed8be2118ba9ac5c38a1ba

        SHA1

        d9afbb6a27e36dd0cc0856da2cd7b58d37dced6b

        SHA256

        26a08ebe726ebf125a241e9ed4d7a22b824dbe082bec0496f2b4d84b0ff75379

        SHA512

        b0b1ac06b29934966b4a7f421d8be13c5d5fb132d30a01ae19e8706eaceb7dbe2e8ba62c3cce51ad34e127c81984ee333a8f90eea104d96e23224cc170a8ce3f

      • memory/872-55-0x0000000074D30000-0x00000000752DB000-memory.dmp

        Filesize

        5.7MB

      • memory/872-66-0x0000000002005000-0x0000000002016000-memory.dmp

        Filesize

        68KB

      • memory/872-54-0x00000000765A1000-0x00000000765A3000-memory.dmp

        Filesize

        8KB

      • memory/872-71-0x0000000002005000-0x0000000002016000-memory.dmp

        Filesize

        68KB

      • memory/872-56-0x0000000074D30000-0x00000000752DB000-memory.dmp

        Filesize

        5.7MB

      • memory/936-83-0x0000000000000000-mapping.dmp

      • memory/1484-62-0x0000000074D30000-0x00000000752DB000-memory.dmp

        Filesize

        5.7MB

      • memory/1484-80-0x0000000074D30000-0x00000000752DB000-memory.dmp

        Filesize

        5.7MB

      • memory/1484-58-0x0000000000000000-mapping.dmp

      • memory/1484-70-0x0000000074D30000-0x00000000752DB000-memory.dmp

        Filesize

        5.7MB

      • memory/1692-68-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/1692-78-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/1692-64-0x0000000000411654-mapping.dmp

      • memory/1692-63-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/1692-85-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/1720-74-0x00000000008200B8-mapping.dmp

      • memory/1772-81-0x0000000000000000-mapping.dmp

      • memory/1812-73-0x0000000000000000-mapping.dmp

      • memory/1812-79-0x0000000074D30000-0x00000000752DB000-memory.dmp

        Filesize

        5.7MB

      • memory/1812-84-0x0000000074D30000-0x00000000752DB000-memory.dmp

        Filesize

        5.7MB