Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 18:17

General

  • Target

    80C6039DC12399E3F771632F0A44C4C3.exe

  • Size

    1.6MB

  • MD5

    80c6039dc12399e3f771632f0a44c4c3

  • SHA1

    f609ba2e8bc0d4b395b83f38a4867fcdb9b6bfdd

  • SHA256

    f6b10c59c9ce33c5c8f6b02c3293fe5d479e59542698c91b15af74bcce50ab8f

  • SHA512

    83b8fb0f9943c11012a82049d7861a3b7ec9753036de402c82ac433a5235cb95a104dd69b29ed110cd9dfe3b8ab062d916956f6f66864bf79876e926c2c5a6a5

  • SSDEEP

    49152:2dh0Omwse7edN51glfneOTS9rFJMkn4Rli/Ea:2dcwN25efeIS9rF6k4RQM

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

stupids

C2

hakim32.ddns.net:2000

hands-social.at.ply.gg:46242

Mutex

d4529f156f8f79f81b02518c9cf09857

Attributes
  • reg_key

    d4529f156f8f79f81b02518c9cf09857

  • splitter

    |'|'|

Extracted

Family

nanocore

Version

1.2.2.0

C2

links-transition.gl.at.ply.gg:41958

127.0.0.1:41958

Mutex

973dbaac-5242-4f6a-aaef-307dad24cdde

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2023-10-14T03:00:38.071092836Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    41958

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    973dbaac-5242-4f6a-aaef-307dad24cdde

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    links-transition.gl.at.ply.gg

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • Nirsoft 4 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80C6039DC12399E3F771632F0A44C4C3.exe
    "C:\Users\Admin\AppData\Local\Temp\80C6039DC12399E3F771632F0A44C4C3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe
      "C:\Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AcABiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AcAB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZQBtACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHAAeQBqACMAPgA="
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3012
      • C:\Users\Admin\AppData\Local\Temp\FreeScript.exe
        "C:\Users\Admin\AppData\Local\Temp\FreeScript.exe"
        3⤵
        • Executes dropped EXE
        PID:2640
      • C:\Users\Admin\AppData\Local\Temp\Server2223.exe
        "C:\Users\Admin\AppData\Local\Temp\Server2223.exe"
        3⤵
        • Executes dropped EXE
        PID:2740
      • C:\Users\Admin\AppData\Local\Temp\Server.exe
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:2632
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAZQBlACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGoAcQB3ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAaQBmACAAZQByAHIAbwByAHMAIABjAG8AbgB0AGEAYwB0ACAAbQBlACAAbQBhAGkAawBrAGkANAAyADAAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAHMAbABwACMAPgA="
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:320
    • C:\Users\Admin\AppData\Local\Temp\sanas.scr
      "C:\Users\Admin\AppData\Local\Temp\sanas.scr" /S
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3032
    • C:\Users\Admin\AppData\Local\Temp\microsofts.exe
      "C:\Users\Admin\AppData\Local\Temp\microsofts.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2852
      • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
        "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\0bvuh0yt.zfe"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:768
      • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
        "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\qad1ehsl.ym4"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2936

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\0bvuh0yt.zfe

          Filesize

          523B

          MD5

          69b2a2e17e78d24abee9f1de2f04811a

          SHA1

          d19c109704e83876ab3527457f9418a7d053aa33

          SHA256

          1b1491f21e64681f8fdc27b2265e2274fb7813eecb6ad8b446d2e431f6300edd

          SHA512

          eb7269979bc4187520636fe3d7b3089f2c7c02e81c4ce2a738ade680f72c61c67fe9577eeaa09d3ca93f34b60be8c434d2cfbfed6566e783f6611279f056150f

        • C:\Users\Admin\AppData\Local\Temp\FreeScript.exe

          Filesize

          913KB

          MD5

          799c188cf6df366f4c0f98b8800a4977

          SHA1

          161d6006518879ecba6cf45b29599992d8eadfce

          SHA256

          32e96ac5e9d2f869ad11ca48401ca8eaeb520027751427145ddb5ab43bce1841

          SHA512

          32a3749f4ef40e9345644c84666207a7c4f0369274cc18f71eecd1eeb6ea22733bc4cc6751f7281bbdff7e0a2187209a6c00653a95d6d39adb4dab06f355e1b1

        • C:\Users\Admin\AppData\Local\Temp\Server2223.exe

          Filesize

          93KB

          MD5

          86757f6c08b6cb698250cc9fc1816a8e

          SHA1

          fa8a2fbc982943a031ad202b3e4b1cdb11bcff6a

          SHA256

          98fa9c5139362be3e25333a7c48229ed220cc61c0dc41b8270e66d2886aa7dff

          SHA512

          cb87cf73deda4299561af9e7c4d65a82816ca5f82890edd76cfec258dbf973b197cd6c40bca2f8643d39f451072e71c5f9529864689cc68097a4382bec97a7dc

        • C:\Users\Admin\AppData\Local\Temp\microsofts.exe

          Filesize

          202KB

          MD5

          5fdd418baf9c0d789e67758ad9f2dd1a

          SHA1

          c0be3be193af670cfe01a64aef7c5b0a0b9d091a

          SHA256

          82f59d1a1a65c0651ae7a965bb6481ba1351ea9efc9f9457de372043709e5a47

          SHA512

          9ace7aed4e4db6f2df7a8df22227079acf176cb7b7e90a0d2638dfd44296653fae6194531a7335fb10fd9396f3cd4f11621715b2a2e4f948209055a809b00c50

        • C:\Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe

          Filesize

          897KB

          MD5

          cff6bd15ff11608502d43c19584783a7

          SHA1

          740c5153ee4e4799d75758007195c6bf0c5d4a40

          SHA256

          0cb43babac1cc190cd461163307ea306f8cf14688889ce6aaa77b1c7548b85bd

          SHA512

          c75fc0bb4abed4fe6dbe74e74dbdc9bf311996aaf7a8dc7870e573d6d6be33d7ce0cc5130160f2099fd6f15c1389c48f909322e5a1fda385dcc8a260c9858e8d

        • \Users\Admin\AppData\Local\Temp\sanas.scr

          Filesize

          183KB

          MD5

          b7cedaa564e3fb095f94aef59f7ed0da

          SHA1

          3f93a84f2d290840cfb5418e15c47dda39ab967d

          SHA256

          526a5aae8d6af5d4af48bef2bf37f6a79b1584b7b48d32bef6a2f6f4ee69ccfc

          SHA512

          18d274dba047179d7cc6b2bb14ede76618bf5c93d8a4b4d1a32bbcf2f6494c9ecc4a601a5a4eae5d7672967be5c3a0c5bfc402f97626638ba7825d6412538f7d

        • \Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe

          Filesize

          1.0MB

          MD5

          5f2ee29ef8f1d3ce52051b89eb690636

          SHA1

          06ac76ef4070e0f0144f151f0ed927042789258a

          SHA256

          bd2faaed9c8559f55ee3bfce7658b27dc21cfc5606c665561401dc5fdad7c14b

          SHA512

          bcc2b3e8e2032c58daa2ed554888b97c34cc60e085f713cce5f5593aec0f7ad4213cd684e3e1e1ff06ac8466342f6e2c9a9133531d2579649a06f397d26b3800

        • memory/320-62-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/320-90-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/320-114-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/320-91-0x0000000002E80000-0x0000000002EC0000-memory.dmp

          Filesize

          256KB

        • memory/320-65-0x0000000002E80000-0x0000000002EC0000-memory.dmp

          Filesize

          256KB

        • memory/320-63-0x0000000002E80000-0x0000000002EC0000-memory.dmp

          Filesize

          256KB

        • memory/768-99-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/768-106-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/768-108-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/768-104-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/768-102-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/768-112-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/768-100-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/768-97-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/768-117-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/768-93-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/2632-89-0x0000000000930000-0x00000000009B0000-memory.dmp

          Filesize

          512KB

        • memory/2632-88-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

          Filesize

          9.6MB

        • memory/2632-113-0x0000000000930000-0x00000000009B0000-memory.dmp

          Filesize

          512KB

        • memory/2632-58-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

          Filesize

          9.6MB

        • memory/2632-80-0x0000000000930000-0x00000000009B0000-memory.dmp

          Filesize

          512KB

        • memory/2632-59-0x0000000000930000-0x00000000009B0000-memory.dmp

          Filesize

          512KB

        • memory/2632-78-0x0000000000930000-0x00000000009B0000-memory.dmp

          Filesize

          512KB

        • memory/2632-110-0x0000000000930000-0x00000000009B0000-memory.dmp

          Filesize

          512KB

        • memory/2632-94-0x0000000000930000-0x00000000009B0000-memory.dmp

          Filesize

          512KB

        • memory/2632-68-0x0000000000930000-0x00000000009B0000-memory.dmp

          Filesize

          512KB

        • memory/2740-61-0x0000000002130000-0x0000000002170000-memory.dmp

          Filesize

          256KB

        • memory/2740-76-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/2740-60-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/2852-66-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/2852-53-0x00000000004A0000-0x00000000004E0000-memory.dmp

          Filesize

          256KB

        • memory/2852-92-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/2852-57-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/2852-86-0x00000000004A0000-0x00000000004E0000-memory.dmp

          Filesize

          256KB

        • memory/2852-87-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/2936-140-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2936-123-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2936-121-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2936-127-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2936-125-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2936-131-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2936-119-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2936-133-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2936-134-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/3012-64-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/3012-67-0x00000000737C0000-0x0000000073D6B000-memory.dmp

          Filesize

          5.7MB

        • memory/3032-109-0x0000000000AE0000-0x0000000000B60000-memory.dmp

          Filesize

          512KB

        • memory/3032-51-0x0000000000AE0000-0x0000000000B60000-memory.dmp

          Filesize

          512KB

        • memory/3032-52-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

          Filesize

          9.6MB

        • memory/3032-77-0x0000000000AE0000-0x0000000000B60000-memory.dmp

          Filesize

          512KB

        • memory/3032-96-0x0000000000AE0000-0x0000000000B60000-memory.dmp

          Filesize

          512KB

        • memory/3032-79-0x0000000000AE0000-0x0000000000B60000-memory.dmp

          Filesize

          512KB

        • memory/3032-84-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

          Filesize

          9.6MB

        • memory/3032-69-0x0000000000AE0000-0x0000000000B60000-memory.dmp

          Filesize

          512KB

        • memory/3032-111-0x0000000000AE0000-0x0000000000B60000-memory.dmp

          Filesize

          512KB

        • memory/3032-85-0x0000000000AE0000-0x0000000000B60000-memory.dmp

          Filesize

          512KB

        • memory/3032-50-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

          Filesize

          9.6MB