Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2023 17:11
Static task
static1
Behavioral task
behavioral1
Sample
4a9efd5ecea388e5ce1d20b75060874b.exe
Resource
win7-20230220-en
General
-
Target
4a9efd5ecea388e5ce1d20b75060874b.exe
-
Size
2.0MB
-
MD5
4a9efd5ecea388e5ce1d20b75060874b
-
SHA1
5cd3796b22f4c126df395f4fbb4285a3997ec345
-
SHA256
a7e5ba6eb88830abc5baa063d667d36a786cd9c845b6d3536aa2c5405332e74b
-
SHA512
08186d35b539c1984384de0bcf36faf510b997a39f06661c9de573843357dcffbb6c7f750e578f30570dadc3fde2166ee0f1b11e1bcf883d4bef197409c6c006
-
SSDEEP
3072:OgdUd3vlTmL/A5nzbYHnzVO9qtD2jW+/5LUa:adfiAxbYHnz5ay+/5L
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
juancaf4000.duckdns.org:5050
2925ee0393c24d569
-
reg_key
2925ee0393c24d569
-
splitter
@!#&^%$
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
monost.exemonost.exepid process 2712 monost.exe 3792 monost.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
4a9efd5ecea388e5ce1d20b75060874b.exemonost.exemonost.exedescription pid process target process PID 4572 set thread context of 4316 4572 4a9efd5ecea388e5ce1d20b75060874b.exe vbc.exe PID 2712 set thread context of 4452 2712 monost.exe vbc.exe PID 3792 set thread context of 3984 3792 monost.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4100 schtasks.exe 4388 schtasks.exe 4220 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe Token: 33 4316 vbc.exe Token: SeIncBasePriorityPrivilege 4316 vbc.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
4a9efd5ecea388e5ce1d20b75060874b.execmd.exemonost.execmd.exemonost.execmd.exedescription pid process target process PID 4572 wrote to memory of 4316 4572 4a9efd5ecea388e5ce1d20b75060874b.exe vbc.exe PID 4572 wrote to memory of 4316 4572 4a9efd5ecea388e5ce1d20b75060874b.exe vbc.exe PID 4572 wrote to memory of 4316 4572 4a9efd5ecea388e5ce1d20b75060874b.exe vbc.exe PID 4572 wrote to memory of 4316 4572 4a9efd5ecea388e5ce1d20b75060874b.exe vbc.exe PID 4572 wrote to memory of 4316 4572 4a9efd5ecea388e5ce1d20b75060874b.exe vbc.exe PID 4572 wrote to memory of 4316 4572 4a9efd5ecea388e5ce1d20b75060874b.exe vbc.exe PID 4572 wrote to memory of 4316 4572 4a9efd5ecea388e5ce1d20b75060874b.exe vbc.exe PID 4572 wrote to memory of 4316 4572 4a9efd5ecea388e5ce1d20b75060874b.exe vbc.exe PID 4572 wrote to memory of 3920 4572 4a9efd5ecea388e5ce1d20b75060874b.exe cmd.exe PID 4572 wrote to memory of 3920 4572 4a9efd5ecea388e5ce1d20b75060874b.exe cmd.exe PID 4572 wrote to memory of 3920 4572 4a9efd5ecea388e5ce1d20b75060874b.exe cmd.exe PID 4572 wrote to memory of 2516 4572 4a9efd5ecea388e5ce1d20b75060874b.exe cmd.exe PID 4572 wrote to memory of 2516 4572 4a9efd5ecea388e5ce1d20b75060874b.exe cmd.exe PID 4572 wrote to memory of 2516 4572 4a9efd5ecea388e5ce1d20b75060874b.exe cmd.exe PID 2516 wrote to memory of 4220 2516 cmd.exe schtasks.exe PID 2516 wrote to memory of 4220 2516 cmd.exe schtasks.exe PID 2516 wrote to memory of 4220 2516 cmd.exe schtasks.exe PID 4572 wrote to memory of 2704 4572 4a9efd5ecea388e5ce1d20b75060874b.exe cmd.exe PID 4572 wrote to memory of 2704 4572 4a9efd5ecea388e5ce1d20b75060874b.exe cmd.exe PID 4572 wrote to memory of 2704 4572 4a9efd5ecea388e5ce1d20b75060874b.exe cmd.exe PID 2712 wrote to memory of 4452 2712 monost.exe vbc.exe PID 2712 wrote to memory of 4452 2712 monost.exe vbc.exe PID 2712 wrote to memory of 4452 2712 monost.exe vbc.exe PID 2712 wrote to memory of 4452 2712 monost.exe vbc.exe PID 2712 wrote to memory of 4452 2712 monost.exe vbc.exe PID 2712 wrote to memory of 4452 2712 monost.exe vbc.exe PID 2712 wrote to memory of 4452 2712 monost.exe vbc.exe PID 2712 wrote to memory of 4452 2712 monost.exe vbc.exe PID 2712 wrote to memory of 4328 2712 monost.exe cmd.exe PID 2712 wrote to memory of 4328 2712 monost.exe cmd.exe PID 2712 wrote to memory of 4328 2712 monost.exe cmd.exe PID 2712 wrote to memory of 3152 2712 monost.exe cmd.exe PID 2712 wrote to memory of 3152 2712 monost.exe cmd.exe PID 2712 wrote to memory of 3152 2712 monost.exe cmd.exe PID 3152 wrote to memory of 4100 3152 cmd.exe schtasks.exe PID 3152 wrote to memory of 4100 3152 cmd.exe schtasks.exe PID 3152 wrote to memory of 4100 3152 cmd.exe schtasks.exe PID 2712 wrote to memory of 3412 2712 monost.exe cmd.exe PID 2712 wrote to memory of 3412 2712 monost.exe cmd.exe PID 2712 wrote to memory of 3412 2712 monost.exe cmd.exe PID 3792 wrote to memory of 3984 3792 monost.exe vbc.exe PID 3792 wrote to memory of 3984 3792 monost.exe vbc.exe PID 3792 wrote to memory of 3984 3792 monost.exe vbc.exe PID 3792 wrote to memory of 3984 3792 monost.exe vbc.exe PID 3792 wrote to memory of 3984 3792 monost.exe vbc.exe PID 3792 wrote to memory of 3984 3792 monost.exe vbc.exe PID 3792 wrote to memory of 3984 3792 monost.exe vbc.exe PID 3792 wrote to memory of 3984 3792 monost.exe vbc.exe PID 3792 wrote to memory of 3780 3792 monost.exe cmd.exe PID 3792 wrote to memory of 3780 3792 monost.exe cmd.exe PID 3792 wrote to memory of 3780 3792 monost.exe cmd.exe PID 3792 wrote to memory of 1340 3792 monost.exe cmd.exe PID 3792 wrote to memory of 1340 3792 monost.exe cmd.exe PID 3792 wrote to memory of 1340 3792 monost.exe cmd.exe PID 1340 wrote to memory of 4388 1340 cmd.exe schtasks.exe PID 1340 wrote to memory of 4388 1340 cmd.exe schtasks.exe PID 1340 wrote to memory of 4388 1340 cmd.exe schtasks.exe PID 3792 wrote to memory of 4884 3792 monost.exe cmd.exe PID 3792 wrote to memory of 4884 3792 monost.exe cmd.exe PID 3792 wrote to memory of 4884 3792 monost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a9efd5ecea388e5ce1d20b75060874b.exe"C:\Users\Admin\AppData\Local\Temp\4a9efd5ecea388e5ce1d20b75060874b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\monost"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\monost\monost.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\monost\monost.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\4a9efd5ecea388e5ce1d20b75060874b.exe" "C:\Users\Admin\AppData\Roaming\monost\monost.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\monost\monost.exeC:\Users\Admin\AppData\Roaming\monost\monost.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\monost"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\monost\monost.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\monost\monost.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\monost\monost.exe" "C:\Users\Admin\AppData\Roaming\monost\monost.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\monost\monost.exeC:\Users\Admin\AppData\Roaming\monost\monost.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\monost"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\monost\monost.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\monost\monost.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\monost\monost.exe" "C:\Users\Admin\AppData\Roaming\monost\monost.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\monost.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.logFilesize
418B
MD589c8a5340eb284f551067d44e27ae8dd
SHA1d2431ae25a1ab67762a5125574f046f4c951d297
SHA25673ca1f27b1c153e3405856ebe8b3c6cdd23424d2ab09c0fe1eb0e2075513057b
SHA512b101ac2e008bd3cc6f97fedb97b8253fb07fed1c334629ecbebe0f4942ccc1070491cddc4daea521164543b6f97ba9b99d2be1c50cc5a013f04e697fea9dbdac
-
C:\Users\Admin\AppData\Roaming\monost\monost.exeFilesize
2.0MB
MD54a9efd5ecea388e5ce1d20b75060874b
SHA15cd3796b22f4c126df395f4fbb4285a3997ec345
SHA256a7e5ba6eb88830abc5baa063d667d36a786cd9c845b6d3536aa2c5405332e74b
SHA51208186d35b539c1984384de0bcf36faf510b997a39f06661c9de573843357dcffbb6c7f750e578f30570dadc3fde2166ee0f1b11e1bcf883d4bef197409c6c006
-
C:\Users\Admin\AppData\Roaming\monost\monost.exeFilesize
2.0MB
MD54a9efd5ecea388e5ce1d20b75060874b
SHA15cd3796b22f4c126df395f4fbb4285a3997ec345
SHA256a7e5ba6eb88830abc5baa063d667d36a786cd9c845b6d3536aa2c5405332e74b
SHA51208186d35b539c1984384de0bcf36faf510b997a39f06661c9de573843357dcffbb6c7f750e578f30570dadc3fde2166ee0f1b11e1bcf883d4bef197409c6c006
-
C:\Users\Admin\AppData\Roaming\monost\monost.exeFilesize
2.0MB
MD54a9efd5ecea388e5ce1d20b75060874b
SHA15cd3796b22f4c126df395f4fbb4285a3997ec345
SHA256a7e5ba6eb88830abc5baa063d667d36a786cd9c845b6d3536aa2c5405332e74b
SHA51208186d35b539c1984384de0bcf36faf510b997a39f06661c9de573843357dcffbb6c7f750e578f30570dadc3fde2166ee0f1b11e1bcf883d4bef197409c6c006
-
memory/2712-148-0x0000000000FF0000-0x0000000001000000-memory.dmpFilesize
64KB
-
memory/3792-154-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/4316-137-0x0000000005B10000-0x00000000060B4000-memory.dmpFilesize
5.6MB
-
memory/4316-144-0x0000000005930000-0x0000000005996000-memory.dmpFilesize
408KB
-
memory/4316-145-0x0000000005630000-0x0000000005640000-memory.dmpFilesize
64KB
-
memory/4316-143-0x0000000005670000-0x000000000567A000-memory.dmpFilesize
40KB
-
memory/4316-142-0x0000000005630000-0x0000000005640000-memory.dmpFilesize
64KB
-
memory/4316-141-0x00000000056E0000-0x0000000005772000-memory.dmpFilesize
584KB
-
memory/4316-136-0x00000000054C0000-0x000000000555C000-memory.dmpFilesize
624KB
-
memory/4316-135-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4572-133-0x0000000000E10000-0x0000000000E2E000-memory.dmpFilesize
120KB
-
memory/4572-134-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB