Analysis
- max time kernel
161s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
16/05/2023, 23:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c460cc5e08dc4af7091bde8d32458646.exe
Resource
win7-20230220-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
c460cc5e08dc4af7091bde8d32458646.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target c460cc5e08dc4af7091bde8d32458646.exe
- Size 336KB
- Sample230516-2586msch97
- SHA256 8525d0bc1e38bb74d592de9be2615da94ec0b81e611b0e456b3a51c40ab5baa3
- MD5 c460cc5e08dc4af7091bde8d32458646
- SHA1 f9c591e5e8b8806b682302e1231ba1f95c712b92
- SHA512 05e5c28d5dbecc27bedffcb7af93185f90a74098c89fc55daebd5c8841f8ee5f903baab9bbce694b4dd5d2dd399463867b608320d56393f7c052cfabb238fd99
- SSDEEP 6144:ygZiAEAO0sByNsAal3gVAWgS7/OhwjMT+tkwsN/4:ygZXEAO/BUdG3gVdt7K9T+tkwq4
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
SkyF
C2
-
4.tcp.eu.ngrok.io:18541
Mutex
-
23b1abca6d5778c7b565b54cf98e9cd1
Attributes
-
reg_key
23b1abca6d5778c7b565b54cf98e9cd1
-
splitter
|'|'|
Signatures
- Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4620 netsh.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation c460cc5e08dc4af7091bde8d32458646.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation NeverBind.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\23b1abca6d5778c7b565b54cf98e9cd1.exe Dl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\23b1abca6d5778c7b565b54cf98e9cd1.exe Dl.exe - Executes dropped EXE 2 IoCs
pid Process 856 NeverBind.exe 2548 Dl.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\23b1abca6d5778c7b565b54cf98e9cd1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dl.exe\" .." Dl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\23b1abca6d5778c7b565b54cf98e9cd1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dl.exe\" .." Dl.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf Dl.exe File opened for modification C:\autorun.inf Dl.exe File created D:\autorun.inf Dl.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 1 IoCs
pid Process 4628 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe 2548 Dl.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2548 Dl.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 2548 Dl.exe Token: SeDebugPrivilege 4628 taskkill.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe Token: 33 2548 Dl.exe Token: SeIncBasePriorityPrivilege 2548 Dl.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 700 wrote to memory of 856 700 c460cc5e08dc4af7091bde8d32458646.exe 84 PID 700 wrote to memory of 856 700 c460cc5e08dc4af7091bde8d32458646.exe 84 PID 700 wrote to memory of 856 700 c460cc5e08dc4af7091bde8d32458646.exe 84 PID 856 wrote to memory of 2548 856 NeverBind.exe 89 PID 856 wrote to memory of 2548 856 NeverBind.exe 89 PID 856 wrote to memory of 2548 856 NeverBind.exe 89 PID 2548 wrote to memory of 4620 2548 Dl.exe 93 PID 2548 wrote to memory of 4620 2548 Dl.exe 93 PID 2548 wrote to memory of 4620 2548 Dl.exe 93 PID 2548 wrote to memory of 4628 2548 Dl.exe 95 PID 2548 wrote to memory of 4628 2548 Dl.exe 95 PID 2548 wrote to memory of 4628 2548 Dl.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\c460cc5e08dc4af7091bde8d32458646.exe"C:\Users\Admin\AppData\Local\Temp\c460cc5e08dc4af7091bde8d32458646.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\NeverBind.exe"C:\Users\Admin\AppData\Local\Temp\NeverBind.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Roaming\Dl.exe"C:\Users\Admin\AppData\Roaming\Dl.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Dl.exe" "Dl.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:4620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\NeverBind.exe
- Size 37KB
- SHA256 c6d98780a6d2ea326eb19eaf1e92a2eccfcc3bc949b466ab35bbad4cb25a50e8
- MD5 78aede0fbcb5a5d7ad6f3cc432bcdbaf
- SHA1 c3f8193af197c884c8b22c2cb93add9a77b68948
- SHA512 e0feb2636f1fa5d26b30169c0134b6c1f0f012ac7e08ca776750ea165862f4eb21c08d08868d725d5d85c73844d474c3136f686c638d7b367c0c3c7256cad7f2
- SSDEEP 384:bOJTgiG1CPZfursvO6yszi7oPJoTnuG6rAF+rMRTyN/0L+EcoinblneHQM3epzX9:KJ/5Wpszi7o2Tu5rM+rMRa8Nu8gt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\NeverBind.exe
- Size 37KB
- SHA256 c6d98780a6d2ea326eb19eaf1e92a2eccfcc3bc949b466ab35bbad4cb25a50e8
- MD5 78aede0fbcb5a5d7ad6f3cc432bcdbaf
- SHA1 c3f8193af197c884c8b22c2cb93add9a77b68948
- SHA512 e0feb2636f1fa5d26b30169c0134b6c1f0f012ac7e08ca776750ea165862f4eb21c08d08868d725d5d85c73844d474c3136f686c638d7b367c0c3c7256cad7f2
- SSDEEP 384:bOJTgiG1CPZfursvO6yszi7oPJoTnuG6rAF+rMRTyN/0L+EcoinblneHQM3epzX9:KJ/5Wpszi7o2Tu5rM+rMRa8Nu8gt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\NeverBind.exe
- Size 37KB
- SHA256 c6d98780a6d2ea326eb19eaf1e92a2eccfcc3bc949b466ab35bbad4cb25a50e8
- MD5 78aede0fbcb5a5d7ad6f3cc432bcdbaf
- SHA1 c3f8193af197c884c8b22c2cb93add9a77b68948
- SHA512 e0feb2636f1fa5d26b30169c0134b6c1f0f012ac7e08ca776750ea165862f4eb21c08d08868d725d5d85c73844d474c3136f686c638d7b367c0c3c7256cad7f2
- SSDEEP 384:bOJTgiG1CPZfursvO6yszi7oPJoTnuG6rAF+rMRTyN/0L+EcoinblneHQM3epzX9:KJ/5Wpszi7o2Tu5rM+rMRa8Nu8gt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Dl.exe
- Size 37KB
- SHA256 c6d98780a6d2ea326eb19eaf1e92a2eccfcc3bc949b466ab35bbad4cb25a50e8
- MD5 78aede0fbcb5a5d7ad6f3cc432bcdbaf
- SHA1 c3f8193af197c884c8b22c2cb93add9a77b68948
- SHA512 e0feb2636f1fa5d26b30169c0134b6c1f0f012ac7e08ca776750ea165862f4eb21c08d08868d725d5d85c73844d474c3136f686c638d7b367c0c3c7256cad7f2
- SSDEEP 384:bOJTgiG1CPZfursvO6yszi7oPJoTnuG6rAF+rMRTyN/0L+EcoinblneHQM3epzX9:KJ/5Wpszi7o2Tu5rM+rMRa8Nu8gt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Dl.exe
- Size 37KB
- SHA256 c6d98780a6d2ea326eb19eaf1e92a2eccfcc3bc949b466ab35bbad4cb25a50e8
- MD5 78aede0fbcb5a5d7ad6f3cc432bcdbaf
- SHA1 c3f8193af197c884c8b22c2cb93add9a77b68948
- SHA512 e0feb2636f1fa5d26b30169c0134b6c1f0f012ac7e08ca776750ea165862f4eb21c08d08868d725d5d85c73844d474c3136f686c638d7b367c0c3c7256cad7f2
- SSDEEP 384:bOJTgiG1CPZfursvO6yszi7oPJoTnuG6rAF+rMRTyN/0L+EcoinblneHQM3epzX9:KJ/5Wpszi7o2Tu5rM+rMRa8Nu8gt
- MD5 SHA1 SHA512 SSDEEP