Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2023 05:56
Behavioral task
behavioral1
Sample
b8f529f21da8c2911d16d1f449e032b9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b8f529f21da8c2911d16d1f449e032b9.exe
Resource
win10v2004-20220812-en
General
-
Target
b8f529f21da8c2911d16d1f449e032b9.exe
-
Size
37KB
-
MD5
b8f529f21da8c2911d16d1f449e032b9
-
SHA1
001e8f2ac0d2564d7705968963e96066094b1df5
-
SHA256
88e3bab355b6b571d1a5d1da2b80d8e1d5f769f39f0b9d2189a6e432eaa031b1
-
SHA512
0b727c878743ba7fdac95c30033b705e45966734a14c63959a78a09429f8cd72cd32d09ed89b8fb2fe0fe84cd75680a1a498c07bdd752bf53412e8ba9d62b350
-
SSDEEP
768:1IPrJ/cPFon04M9udrM+rMRa8Nuf1btQ:1orJ0NoxMoG+gRJN41
Malware Config
Extracted
njrat
im523
Dibil
7.tcp.eu.ngrok.io:16592
ed673d626997c5d6f8f983c3110e8aab
-
reg_key
ed673d626997c5d6f8f983c3110e8aab
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Realtek HD Audio Universal Windows.exepid process 4380 Realtek HD Audio Universal Windows.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b8f529f21da8c2911d16d1f449e032b9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation b8f529f21da8c2911d16d1f449e032b9.exe -
Drops startup file 2 IoCs
Processes:
Realtek HD Audio Universal Windows.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ed673d626997c5d6f8f983c3110e8aab.exe Realtek HD Audio Universal Windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ed673d626997c5d6f8f983c3110e8aab.exe Realtek HD Audio Universal Windows.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Realtek HD Audio Universal Windows.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ed673d626997c5d6f8f983c3110e8aab = "\"C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Windows.exe\" .." Realtek HD Audio Universal Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ed673d626997c5d6f8f983c3110e8aab = "\"C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Windows.exe\" .." Realtek HD Audio Universal Windows.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
Realtek HD Audio Universal Windows.exedescription ioc process File opened for modification C:\autorun.inf Realtek HD Audio Universal Windows.exe File created D:\autorun.inf Realtek HD Audio Universal Windows.exe File created C:\autorun.inf Realtek HD Audio Universal Windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Realtek HD Audio Universal Windows.exepid process 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe 4380 Realtek HD Audio Universal Windows.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Realtek HD Audio Universal Windows.exepid process 4380 Realtek HD Audio Universal Windows.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
Realtek HD Audio Universal Windows.exedescription pid process Token: SeDebugPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe Token: 33 4380 Realtek HD Audio Universal Windows.exe Token: SeIncBasePriorityPrivilege 4380 Realtek HD Audio Universal Windows.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b8f529f21da8c2911d16d1f449e032b9.exeRealtek HD Audio Universal Windows.exedescription pid process target process PID 1504 wrote to memory of 4380 1504 b8f529f21da8c2911d16d1f449e032b9.exe Realtek HD Audio Universal Windows.exe PID 1504 wrote to memory of 4380 1504 b8f529f21da8c2911d16d1f449e032b9.exe Realtek HD Audio Universal Windows.exe PID 1504 wrote to memory of 4380 1504 b8f529f21da8c2911d16d1f449e032b9.exe Realtek HD Audio Universal Windows.exe PID 4380 wrote to memory of 3616 4380 Realtek HD Audio Universal Windows.exe netsh.exe PID 4380 wrote to memory of 3616 4380 Realtek HD Audio Universal Windows.exe netsh.exe PID 4380 wrote to memory of 3616 4380 Realtek HD Audio Universal Windows.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8f529f21da8c2911d16d1f449e032b9.exe"C:\Users\Admin\AppData\Local\Temp\b8f529f21da8c2911d16d1f449e032b9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe"C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exe" "Realtek HD Audio Universal Windows.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exeFilesize
37KB
MD5b8f529f21da8c2911d16d1f449e032b9
SHA1001e8f2ac0d2564d7705968963e96066094b1df5
SHA25688e3bab355b6b571d1a5d1da2b80d8e1d5f769f39f0b9d2189a6e432eaa031b1
SHA5120b727c878743ba7fdac95c30033b705e45966734a14c63959a78a09429f8cd72cd32d09ed89b8fb2fe0fe84cd75680a1a498c07bdd752bf53412e8ba9d62b350
-
C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Windows.exeFilesize
37KB
MD5b8f529f21da8c2911d16d1f449e032b9
SHA1001e8f2ac0d2564d7705968963e96066094b1df5
SHA25688e3bab355b6b571d1a5d1da2b80d8e1d5f769f39f0b9d2189a6e432eaa031b1
SHA5120b727c878743ba7fdac95c30033b705e45966734a14c63959a78a09429f8cd72cd32d09ed89b8fb2fe0fe84cd75680a1a498c07bdd752bf53412e8ba9d62b350
-
memory/1504-132-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/1504-136-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/3616-138-0x0000000000000000-mapping.dmp
-
memory/4380-133-0x0000000000000000-mapping.dmp
-
memory/4380-137-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/4380-139-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB