Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 09:26
Behavioral task
behavioral1
Sample
0242b77912d11030997cbf549f41a61c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0242b77912d11030997cbf549f41a61c.exe
Resource
win10v2004-20220812-en
General
-
Target
0242b77912d11030997cbf549f41a61c.exe
-
Size
37KB
-
MD5
0242b77912d11030997cbf549f41a61c
-
SHA1
d0fabf4bf6adff8f2ae3f827bf0a815fe00513cf
-
SHA256
d143d732effee86f0bc7a3862cfbc20b3ff1f0759aa997b7a8a3e5568fdd4337
-
SHA512
52d1b86eb23d6bca79c2752a3a5d43ac5617495a8b0a9d387492e8eef9a56067913ddb79b6dab7228bde473cdca9713d69d642f6b04eac52bbb6cd15e23c706c
-
SSDEEP
384:oalQmY98iM6caSGAZ0ytfBPGHlegiuIWnrAF+rMRTyN/0L+EcoinblneHQM3epzS:9QmGp2Z3tfBPGk9udrM+rMRa8NuW/t
Malware Config
Extracted
njrat
im523
Dibil
7.tcp.eu.ngrok.io:18097
7bb786d3a71613dbb1f2bee12d98405a
-
reg_key
7bb786d3a71613dbb1f2bee12d98405a
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Realtek HD Audio Universal Windows.exepid process 760 Realtek HD Audio Universal Windows.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Realtek HD Audio Universal Windows.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7bb786d3a71613dbb1f2bee12d98405a.exe Realtek HD Audio Universal Windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7bb786d3a71613dbb1f2bee12d98405a.exe Realtek HD Audio Universal Windows.exe -
Loads dropped DLL 1 IoCs
Processes:
0242b77912d11030997cbf549f41a61c.exepid process 620 0242b77912d11030997cbf549f41a61c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Realtek HD Audio Universal Windows.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\7bb786d3a71613dbb1f2bee12d98405a = "\"C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Windows.exe\" .." Realtek HD Audio Universal Windows.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\7bb786d3a71613dbb1f2bee12d98405a = "\"C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Windows.exe\" .." Realtek HD Audio Universal Windows.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
Realtek HD Audio Universal Windows.exedescription ioc process File created C:\autorun.inf Realtek HD Audio Universal Windows.exe File opened for modification C:\autorun.inf Realtek HD Audio Universal Windows.exe File created D:\autorun.inf Realtek HD Audio Universal Windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Realtek HD Audio Universal Windows.exepid process 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe 760 Realtek HD Audio Universal Windows.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Realtek HD Audio Universal Windows.exepid process 760 Realtek HD Audio Universal Windows.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
Realtek HD Audio Universal Windows.exedescription pid process Token: SeDebugPrivilege 760 Realtek HD Audio Universal Windows.exe Token: 33 760 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 760 Realtek HD Audio Universal Windows.exe Token: 33 760 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 760 Realtek HD Audio Universal Windows.exe Token: 33 760 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 760 Realtek HD Audio Universal Windows.exe Token: 33 760 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 760 Realtek HD Audio Universal Windows.exe Token: 33 760 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 760 Realtek HD Audio Universal Windows.exe Token: 33 760 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 760 Realtek HD Audio Universal Windows.exe Token: 33 760 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 760 Realtek HD Audio Universal Windows.exe Token: 33 760 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 760 Realtek HD Audio Universal Windows.exe Token: 33 760 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 760 Realtek HD Audio Universal Windows.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0242b77912d11030997cbf549f41a61c.exeRealtek HD Audio Universal Windows.exedescription pid process target process PID 620 wrote to memory of 760 620 0242b77912d11030997cbf549f41a61c.exe Realtek HD Audio Universal Windows.exe PID 620 wrote to memory of 760 620 0242b77912d11030997cbf549f41a61c.exe Realtek HD Audio Universal Windows.exe PID 620 wrote to memory of 760 620 0242b77912d11030997cbf549f41a61c.exe Realtek HD Audio Universal Windows.exe PID 620 wrote to memory of 760 620 0242b77912d11030997cbf549f41a61c.exe Realtek HD Audio Universal Windows.exe PID 760 wrote to memory of 368 760 Realtek HD Audio Universal Windows.exe netsh.exe PID 760 wrote to memory of 368 760 Realtek HD Audio Universal Windows.exe netsh.exe PID 760 wrote to memory of 368 760 Realtek HD Audio Universal Windows.exe netsh.exe PID 760 wrote to memory of 368 760 Realtek HD Audio Universal Windows.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0242b77912d11030997cbf549f41a61c.exe"C:\Users\Admin\AppData\Local\Temp\0242b77912d11030997cbf549f41a61c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe"C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe" "Realtek HD Audio Universal Windows.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exeFilesize
37KB
MD50242b77912d11030997cbf549f41a61c
SHA1d0fabf4bf6adff8f2ae3f827bf0a815fe00513cf
SHA256d143d732effee86f0bc7a3862cfbc20b3ff1f0759aa997b7a8a3e5568fdd4337
SHA51252d1b86eb23d6bca79c2752a3a5d43ac5617495a8b0a9d387492e8eef9a56067913ddb79b6dab7228bde473cdca9713d69d642f6b04eac52bbb6cd15e23c706c
-
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exeFilesize
37KB
MD50242b77912d11030997cbf549f41a61c
SHA1d0fabf4bf6adff8f2ae3f827bf0a815fe00513cf
SHA256d143d732effee86f0bc7a3862cfbc20b3ff1f0759aa997b7a8a3e5568fdd4337
SHA51252d1b86eb23d6bca79c2752a3a5d43ac5617495a8b0a9d387492e8eef9a56067913ddb79b6dab7228bde473cdca9713d69d642f6b04eac52bbb6cd15e23c706c
-
\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exeFilesize
37KB
MD50242b77912d11030997cbf549f41a61c
SHA1d0fabf4bf6adff8f2ae3f827bf0a815fe00513cf
SHA256d143d732effee86f0bc7a3862cfbc20b3ff1f0759aa997b7a8a3e5568fdd4337
SHA51252d1b86eb23d6bca79c2752a3a5d43ac5617495a8b0a9d387492e8eef9a56067913ddb79b6dab7228bde473cdca9713d69d642f6b04eac52bbb6cd15e23c706c
-
memory/368-63-0x0000000000000000-mapping.dmp
-
memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/620-55-0x0000000074C10000-0x00000000751BB000-memory.dmpFilesize
5.7MB
-
memory/620-61-0x0000000074C10000-0x00000000751BB000-memory.dmpFilesize
5.7MB
-
memory/760-57-0x0000000000000000-mapping.dmp
-
memory/760-62-0x0000000074C10000-0x00000000751BB000-memory.dmpFilesize
5.7MB
-
memory/760-65-0x0000000074C10000-0x00000000751BB000-memory.dmpFilesize
5.7MB