Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 15:11
Behavioral task
behavioral1
Sample
2fd0e5f074ac1797378039bfd9aa2783.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2fd0e5f074ac1797378039bfd9aa2783.exe
Resource
win10v2004-20220901-en
General
-
Target
2fd0e5f074ac1797378039bfd9aa2783.exe
-
Size
37KB
-
MD5
2fd0e5f074ac1797378039bfd9aa2783
-
SHA1
260a02c1aab33a643f549706d0e41b98583c4c80
-
SHA256
c46660f4c6006b2d4fbb1f6b651da9c20895c9acbbf498a506365aca36ab9823
-
SHA512
40af1e03eaf180a51a885160d702997dc675fa66a20608afc582fa0c576d34565d843b582f7f63beb2297c4d55b53006a50c7aaadeb8380b5a02c8459477e2ba
-
SSDEEP
384:HmqaSikHkvmkO8IV+ytbNNOvNEsuKv2rAF+rMRTyN/0L+EcoinblneHQM3epzXQg:G1IV1tbNNO2lK+rM+rMRa8Numgt
Malware Config
Extracted
njrat
im523
Dibil
0.tcp.eu.ngrok.io:18648
ab0232858746b083a3ee8bc3e01cc315
-
reg_key
ab0232858746b083a3ee8bc3e01cc315
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Realtek HD Audio Universal Windows.exepid process 1608 Realtek HD Audio Universal Windows.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2fd0e5f074ac1797378039bfd9aa2783.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 2fd0e5f074ac1797378039bfd9aa2783.exe -
Drops startup file 2 IoCs
Processes:
Realtek HD Audio Universal Windows.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ab0232858746b083a3ee8bc3e01cc315.exe Realtek HD Audio Universal Windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ab0232858746b083a3ee8bc3e01cc315.exe Realtek HD Audio Universal Windows.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Realtek HD Audio Universal Windows.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ab0232858746b083a3ee8bc3e01cc315 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Windows.exe\" .." Realtek HD Audio Universal Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ab0232858746b083a3ee8bc3e01cc315 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Windows.exe\" .." Realtek HD Audio Universal Windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Realtek HD Audio Universal Windows.exepid process 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe 1608 Realtek HD Audio Universal Windows.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Realtek HD Audio Universal Windows.exepid process 1608 Realtek HD Audio Universal Windows.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
Realtek HD Audio Universal Windows.exedescription pid process Token: SeDebugPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe Token: 33 1608 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 1608 Realtek HD Audio Universal Windows.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2fd0e5f074ac1797378039bfd9aa2783.exeRealtek HD Audio Universal Windows.exedescription pid process target process PID 1536 wrote to memory of 1608 1536 2fd0e5f074ac1797378039bfd9aa2783.exe Realtek HD Audio Universal Windows.exe PID 1536 wrote to memory of 1608 1536 2fd0e5f074ac1797378039bfd9aa2783.exe Realtek HD Audio Universal Windows.exe PID 1536 wrote to memory of 1608 1536 2fd0e5f074ac1797378039bfd9aa2783.exe Realtek HD Audio Universal Windows.exe PID 1608 wrote to memory of 2144 1608 Realtek HD Audio Universal Windows.exe netsh.exe PID 1608 wrote to memory of 2144 1608 Realtek HD Audio Universal Windows.exe netsh.exe PID 1608 wrote to memory of 2144 1608 Realtek HD Audio Universal Windows.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fd0e5f074ac1797378039bfd9aa2783.exe"C:\Users\Admin\AppData\Local\Temp\2fd0e5f074ac1797378039bfd9aa2783.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe"C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe" "Realtek HD Audio Universal Windows.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exeFilesize
37KB
MD52fd0e5f074ac1797378039bfd9aa2783
SHA1260a02c1aab33a643f549706d0e41b98583c4c80
SHA256c46660f4c6006b2d4fbb1f6b651da9c20895c9acbbf498a506365aca36ab9823
SHA51240af1e03eaf180a51a885160d702997dc675fa66a20608afc582fa0c576d34565d843b582f7f63beb2297c4d55b53006a50c7aaadeb8380b5a02c8459477e2ba
-
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exeFilesize
37KB
MD52fd0e5f074ac1797378039bfd9aa2783
SHA1260a02c1aab33a643f549706d0e41b98583c4c80
SHA256c46660f4c6006b2d4fbb1f6b651da9c20895c9acbbf498a506365aca36ab9823
SHA51240af1e03eaf180a51a885160d702997dc675fa66a20608afc582fa0c576d34565d843b582f7f63beb2297c4d55b53006a50c7aaadeb8380b5a02c8459477e2ba
-
memory/1536-132-0x0000000075190000-0x0000000075741000-memory.dmpFilesize
5.7MB
-
memory/1536-133-0x0000000075190000-0x0000000075741000-memory.dmpFilesize
5.7MB
-
memory/1536-137-0x0000000075190000-0x0000000075741000-memory.dmpFilesize
5.7MB
-
memory/1608-134-0x0000000000000000-mapping.dmp
-
memory/1608-138-0x0000000075190000-0x0000000075741000-memory.dmpFilesize
5.7MB
-
memory/1608-140-0x0000000075190000-0x0000000075741000-memory.dmpFilesize
5.7MB
-
memory/2144-139-0x0000000000000000-mapping.dmp