Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 19:13
Static task
static1
Behavioral task
behavioral1
Sample
d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe
Resource
win10v2004-20220812-en
General
-
Target
d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe
-
Size
3.4MB
-
MD5
7ef0468daf64cf55ea84b641ff713ddd
-
SHA1
1ec21e9e638947a8ed183d00dfab72e0d1127331
-
SHA256
d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4
-
SHA512
46d2ee7efdd263a2bdc3747f725ee1e2c58dfcce2ad3a0f9c4c4ec754c3b9ff2bf0e9f6be7172a3b06975783069caf3d9d0fb18d11b30037c7aa91baaf0a01dd
-
SSDEEP
98304:Nviz/27qWGq/TzuqCDl2Ptao7jjUUYW3N5:Nviq75/TzufKnN5
Malware Config
Extracted
njrat
im523
?
stallkermonolit9.ddns.net:6522
2090a55760d1c98654faa55422bdd11b
-
reg_key
2090a55760d1c98654faa55422bdd11b
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
CDS.execrypted.exepid process 872 CDS.exe 1708 crypted.exe -
Loads dropped DLL 8 IoCs
Processes:
d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exeCDS.execrypted.exepid process 896 d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe 872 CDS.exe 872 CDS.exe 872 CDS.exe 872 CDS.exe 872 CDS.exe 872 CDS.exe 1708 crypted.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe -
Drops file in Windows directory 2 IoCs
Processes:
crypted.exedescription ioc process File created C:\Windows\инсрукция crypted.exe File opened for modification C:\Windows\инсрукция crypted.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
CDS.exepid process 872 CDS.exe 872 CDS.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1076 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1076 AUDIODG.EXE Token: 33 1076 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1076 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
CDS.exeAcroRd32.exepid process 872 CDS.exe 872 CDS.exe 1768 AcroRd32.exe 1768 AcroRd32.exe 1768 AcroRd32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exeCDS.execrypted.exerundll32.exedescription pid process target process PID 896 wrote to memory of 872 896 d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe CDS.exe PID 896 wrote to memory of 872 896 d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe CDS.exe PID 896 wrote to memory of 872 896 d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe CDS.exe PID 896 wrote to memory of 872 896 d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe CDS.exe PID 896 wrote to memory of 872 896 d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe CDS.exe PID 896 wrote to memory of 872 896 d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe CDS.exe PID 896 wrote to memory of 872 896 d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe CDS.exe PID 872 wrote to memory of 1708 872 CDS.exe crypted.exe PID 872 wrote to memory of 1708 872 CDS.exe crypted.exe PID 872 wrote to memory of 1708 872 CDS.exe crypted.exe PID 872 wrote to memory of 1708 872 CDS.exe crypted.exe PID 872 wrote to memory of 1708 872 CDS.exe crypted.exe PID 872 wrote to memory of 1708 872 CDS.exe crypted.exe PID 872 wrote to memory of 1708 872 CDS.exe crypted.exe PID 1708 wrote to memory of 1092 1708 crypted.exe rundll32.exe PID 1708 wrote to memory of 1092 1708 crypted.exe rundll32.exe PID 1708 wrote to memory of 1092 1708 crypted.exe rundll32.exe PID 1708 wrote to memory of 1092 1708 crypted.exe rundll32.exe PID 1708 wrote to memory of 1092 1708 crypted.exe rundll32.exe PID 1708 wrote to memory of 1092 1708 crypted.exe rundll32.exe PID 1708 wrote to memory of 1092 1708 crypted.exe rundll32.exe PID 1092 wrote to memory of 1768 1092 rundll32.exe AcroRd32.exe PID 1092 wrote to memory of 1768 1092 rundll32.exe AcroRd32.exe PID 1092 wrote to memory of 1768 1092 rundll32.exe AcroRd32.exe PID 1092 wrote to memory of 1768 1092 rundll32.exe AcroRd32.exe PID 1092 wrote to memory of 1768 1092 rundll32.exe AcroRd32.exe PID 1092 wrote to memory of 1768 1092 rundll32.exe AcroRd32.exe PID 1092 wrote to memory of 1768 1092 rundll32.exe AcroRd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe"C:\Users\Admin\AppData\Local\Temp\d3d55145b725f30b6b3c7cff500b0fcb2f1d2c00ef43dbdc1f81a905b7eff8e4.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\инсрукция4⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Windows\инсрукция"5⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.pngFilesize
2KB
MD5340b294efc691d1b20c64175d565ebc7
SHA181cb9649bd1c9a62ae79e781818fc24d15c29ce7
SHA25672566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9
SHA5121395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cddFilesize
13KB
MD53e7ecaeb51c2812d13b07ec852d74aaf
SHA1e9bdab93596ffb0f7f8c65243c579180939acb26
SHA256e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96
SHA512635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.datFilesize
337KB
MD5f12ea9bf6c5c5cd7eaa7b9c1dfdbc528
SHA1230380f1706ed3af508e4bf370bbb63978a5787d
SHA2563fc1198b259b1a9a4fdf4291bea50a4eae6c15709731fbd4bef36036d42fdf2e
SHA5122d36d502198f1b754aa5c0196d875d65140db9ab8780d7d9feb3fef4a709a2a385a9dfd76bdb1c1e91056a2b6f82642f68692ba744a01068ea0cdcb9c8f28fd2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
337KB
MD587187ddf6800e794c2d56177fe0372ba
SHA181a8090569e5f3d56a4f2efc987b518b0ea2d922
SHA2564506a4983762620d57a2e16b57e2887ed5aa56b74c3f328250214aff88f4292c
SHA51265c5fbe1157391baeec246f5b816d0e2c2f6f90886ef31fbf215cb5627f31fdf6538fe49cebb1879a2ad6b4f0fd23cbe6d1557bc7782fed2831cb0a1876a1b5c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
337KB
MD587187ddf6800e794c2d56177fe0372ba
SHA181a8090569e5f3d56a4f2efc987b518b0ea2d922
SHA2564506a4983762620d57a2e16b57e2887ed5aa56b74c3f328250214aff88f4292c
SHA51265c5fbe1157391baeec246f5b816d0e2c2f6f90886ef31fbf215cb5627f31fdf6538fe49cebb1879a2ad6b4f0fd23cbe6d1557bc7782fed2831cb0a1876a1b5c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settingsFilesize
5B
MD568934a3e9455fa72420237eb05902327
SHA17cb6efb98ba5972a9b5090dc2e517fe14d12cb04
SHA256fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
SHA512719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllFilesize
322KB
MD5c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
C:\Windows\инсрукцияFilesize
337KB
MD587187ddf6800e794c2d56177fe0372ba
SHA181a8090569e5f3d56a4f2efc987b518b0ea2d922
SHA2564506a4983762620d57a2e16b57e2887ed5aa56b74c3f328250214aff88f4292c
SHA51265c5fbe1157391baeec246f5b816d0e2c2f6f90886ef31fbf215cb5627f31fdf6538fe49cebb1879a2ad6b4f0fd23cbe6d1557bc7782fed2831cb0a1876a1b5c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeFilesize
6.1MB
MD5424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
337KB
MD587187ddf6800e794c2d56177fe0372ba
SHA181a8090569e5f3d56a4f2efc987b518b0ea2d922
SHA2564506a4983762620d57a2e16b57e2887ed5aa56b74c3f328250214aff88f4292c
SHA51265c5fbe1157391baeec246f5b816d0e2c2f6f90886ef31fbf215cb5627f31fdf6538fe49cebb1879a2ad6b4f0fd23cbe6d1557bc7782fed2831cb0a1876a1b5c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
337KB
MD587187ddf6800e794c2d56177fe0372ba
SHA181a8090569e5f3d56a4f2efc987b518b0ea2d922
SHA2564506a4983762620d57a2e16b57e2887ed5aa56b74c3f328250214aff88f4292c
SHA51265c5fbe1157391baeec246f5b816d0e2c2f6f90886ef31fbf215cb5627f31fdf6538fe49cebb1879a2ad6b4f0fd23cbe6d1557bc7782fed2831cb0a1876a1b5c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
337KB
MD587187ddf6800e794c2d56177fe0372ba
SHA181a8090569e5f3d56a4f2efc987b518b0ea2d922
SHA2564506a4983762620d57a2e16b57e2887ed5aa56b74c3f328250214aff88f4292c
SHA51265c5fbe1157391baeec246f5b816d0e2c2f6f90886ef31fbf215cb5627f31fdf6538fe49cebb1879a2ad6b4f0fd23cbe6d1557bc7782fed2831cb0a1876a1b5c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeFilesize
337KB
MD587187ddf6800e794c2d56177fe0372ba
SHA181a8090569e5f3d56a4f2efc987b518b0ea2d922
SHA2564506a4983762620d57a2e16b57e2887ed5aa56b74c3f328250214aff88f4292c
SHA51265c5fbe1157391baeec246f5b816d0e2c2f6f90886ef31fbf215cb5627f31fdf6538fe49cebb1879a2ad6b4f0fd23cbe6d1557bc7782fed2831cb0a1876a1b5c
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllFilesize
322KB
MD5c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
memory/872-56-0x0000000000000000-mapping.dmp
-
memory/896-54-0x0000000075B41000-0x0000000075B43000-memory.dmpFilesize
8KB
-
memory/1092-78-0x0000000000000000-mapping.dmp
-
memory/1708-71-0x0000000000000000-mapping.dmp
-
memory/1708-76-0x00000000737E0000-0x0000000073D8B000-memory.dmpFilesize
5.7MB
-
memory/1708-77-0x00000000737E0000-0x0000000073D8B000-memory.dmpFilesize
5.7MB
-
memory/1708-80-0x00000000737E0000-0x0000000073D8B000-memory.dmpFilesize
5.7MB
-
memory/1768-82-0x0000000000000000-mapping.dmp