Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 19:54
Behavioral task
behavioral1
Sample
Extreme Injector.v3.7.2.-.by.master131.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Extreme Injector.v3.7.2.-.by.master131.exe
Resource
win10v2004-20221111-en
General
-
Target
Extreme Injector.v3.7.2.-.by.master131.exe
-
Size
174KB
-
MD5
f40ed39309831ba693ab389aa1dc5b56
-
SHA1
80044850f09949adb5c83a42f4e58158f98f10dc
-
SHA256
ec42e0369da6a7296ab3dfadd47b61b857c626e1181333089851ffb088e76740
-
SHA512
a409bbc9e2c3502ab6a792f1194366208535bac4abf634a1f161262b41b144fb9b7fc95b10fa294f79c615b542b47f51bd9b253752cc0c876335baaf82eb746e
-
SSDEEP
1536:+3ZdeRqxoZ+gRJNJoLNAgV5sM7gSA+z874dqlZfFO73AyJpj/CQQmao5GFV2:+3feIq+yJbKNr7Lt3Q7EsYhJVQC5Gv
Malware Config
Extracted
njrat
im523
HacKed
4.tcp.eu.ngrok.io:1604
0b0b7987b03c6cda3a4ba11ac605e050
-
reg_key
0b0b7987b03c6cda3a4ba11ac605e050
-
splitter
|'|'|
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 952 AcroRd32.exe 952 AcroRd32.exe 952 AcroRd32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Extreme Injector.v3.7.2.-.by.master131.exerundll32.exedescription pid process target process PID 1896 wrote to memory of 1272 1896 Extreme Injector.v3.7.2.-.by.master131.exe rundll32.exe PID 1896 wrote to memory of 1272 1896 Extreme Injector.v3.7.2.-.by.master131.exe rundll32.exe PID 1896 wrote to memory of 1272 1896 Extreme Injector.v3.7.2.-.by.master131.exe rundll32.exe PID 1896 wrote to memory of 1272 1896 Extreme Injector.v3.7.2.-.by.master131.exe rundll32.exe PID 1896 wrote to memory of 1272 1896 Extreme Injector.v3.7.2.-.by.master131.exe rundll32.exe PID 1896 wrote to memory of 1272 1896 Extreme Injector.v3.7.2.-.by.master131.exe rundll32.exe PID 1896 wrote to memory of 1272 1896 Extreme Injector.v3.7.2.-.by.master131.exe rundll32.exe PID 1272 wrote to memory of 952 1272 rundll32.exe AcroRd32.exe PID 1272 wrote to memory of 952 1272 rundll32.exe AcroRd32.exe PID 1272 wrote to memory of 952 1272 rundll32.exe AcroRd32.exe PID 1272 wrote to memory of 952 1272 rundll32.exe AcroRd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Extreme Injector.v3.7.2.-.by.master131.exe"C:\Users\Admin\AppData\Local\Temp\Extreme Injector.v3.7.2.-.by.master131.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Google Crash Handler2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Google Crash Handler"3⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Google Crash HandlerFilesize
174KB
MD5f40ed39309831ba693ab389aa1dc5b56
SHA180044850f09949adb5c83a42f4e58158f98f10dc
SHA256ec42e0369da6a7296ab3dfadd47b61b857c626e1181333089851ffb088e76740
SHA512a409bbc9e2c3502ab6a792f1194366208535bac4abf634a1f161262b41b144fb9b7fc95b10fa294f79c615b542b47f51bd9b253752cc0c876335baaf82eb746e
-
memory/952-61-0x0000000000000000-mapping.dmp
-
memory/1272-57-0x0000000000000000-mapping.dmp
-
memory/1896-54-0x00000000763F1000-0x00000000763F3000-memory.dmpFilesize
8KB
-
memory/1896-55-0x0000000074AD0000-0x000000007507B000-memory.dmpFilesize
5.7MB
-
memory/1896-56-0x0000000074AD0000-0x000000007507B000-memory.dmpFilesize
5.7MB
-
memory/1896-58-0x0000000074AD0000-0x000000007507B000-memory.dmpFilesize
5.7MB