Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 20:44
Behavioral task
behavioral1
Sample
af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exe
Resource
win10v2004-20220901-en
General
-
Target
af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exe
-
Size
207KB
-
MD5
80305a0b2bbe713147ac46edf1e3e98b
-
SHA1
9ddd3c3085b9cbb4d1eed3ee1454e0c7a042fd25
-
SHA256
af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62
-
SHA512
c919801b125cb18e72f64eda7f4241468cbdaefbb29ee30c11424d1e2416a708e82f747488f68fdc71e6e85c035ed453cbfa09de2f2b0a5d76edfab6d36062e2
-
SSDEEP
3072:l/ok70dA+C1DEewDw8eA9LIVFxNgvrc2/Ktax09tbSpcl2GTP31EeR:lL1eeyQ
Malware Config
Extracted
njrat
0.7d
KURD_PRDE
kurdprde.noip.me:1177
283733562dbbe5f8a62f7e99d428c246
-
reg_key
283733562dbbe5f8a62f7e99d428c246
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Call Free For Pc .exepid process 3244 Call Free For Pc .exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Call Free For Pc .exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\283733562dbbe5f8a62f7e99d428c246 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Call Free For Pc .exe\" .." Call Free For Pc .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\283733562dbbe5f8a62f7e99d428c246 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Call Free For Pc .exe\" .." Call Free For Pc .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
Call Free For Pc .exedescription pid process Token: SeDebugPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe Token: 33 3244 Call Free For Pc .exe Token: SeIncBasePriorityPrivilege 3244 Call Free For Pc .exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exeCall Free For Pc .exedescription pid process target process PID 3836 wrote to memory of 3244 3836 af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exe Call Free For Pc .exe PID 3836 wrote to memory of 3244 3836 af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exe Call Free For Pc .exe PID 3836 wrote to memory of 3244 3836 af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exe Call Free For Pc .exe PID 3244 wrote to memory of 504 3244 Call Free For Pc .exe netsh.exe PID 3244 wrote to memory of 504 3244 Call Free For Pc .exe netsh.exe PID 3244 wrote to memory of 504 3244 Call Free For Pc .exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exe"C:\Users\Admin\AppData\Local\Temp\af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Call Free For Pc .exe"C:\Users\Admin\AppData\Local\Temp\Call Free For Pc .exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Call Free For Pc .exe" "Call Free For Pc .exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Call Free For Pc .exeFilesize
207KB
MD580305a0b2bbe713147ac46edf1e3e98b
SHA19ddd3c3085b9cbb4d1eed3ee1454e0c7a042fd25
SHA256af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62
SHA512c919801b125cb18e72f64eda7f4241468cbdaefbb29ee30c11424d1e2416a708e82f747488f68fdc71e6e85c035ed453cbfa09de2f2b0a5d76edfab6d36062e2
-
C:\Users\Admin\AppData\Local\Temp\Call Free For Pc .exeFilesize
207KB
MD580305a0b2bbe713147ac46edf1e3e98b
SHA19ddd3c3085b9cbb4d1eed3ee1454e0c7a042fd25
SHA256af8f36deface0d891ad947f70f47f9e6febdd117a9bc8cdcf9fb9dd08c23bf62
SHA512c919801b125cb18e72f64eda7f4241468cbdaefbb29ee30c11424d1e2416a708e82f747488f68fdc71e6e85c035ed453cbfa09de2f2b0a5d76edfab6d36062e2
-
memory/504-138-0x0000000000000000-mapping.dmp
-
memory/3244-133-0x0000000000000000-mapping.dmp
-
memory/3244-137-0x0000000074890000-0x0000000074E41000-memory.dmpFilesize
5.7MB
-
memory/3244-139-0x0000000074890000-0x0000000074E41000-memory.dmpFilesize
5.7MB
-
memory/3836-132-0x0000000074890000-0x0000000074E41000-memory.dmpFilesize
5.7MB
-
memory/3836-136-0x0000000074890000-0x0000000074E41000-memory.dmpFilesize
5.7MB