Analysis
-
max time kernel
150s -
max time network
64s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-02-2021 07:18
Static task
static1
Behavioral task
behavioral1
Sample
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe
Resource
win10v20201028
General
-
Target
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe
-
Size
863KB
-
MD5
8b32e28becfe5553d9b59e6ea2973265
-
SHA1
e731235f8faeb6d04d936ebb69b7032132663566
-
SHA256
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f
-
SHA512
6dae649db1d6033850741bb8cc316f222b6f5d476097f1a581fdad5e42f98e667a70457f2fbf0a30870b47976fe5a39c38e8f745ebcc22745e2ce4b3c466ff4a
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:5552
279f6960ed84a752570aca7fb2dc1552
-
reg_key
279f6960ed84a752570aca7fb2dc1552
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
2982.exeserver.exepid process 1500 2982.exe 996 server.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 4 IoCs
Processes:
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe2982.exepid process 336 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 336 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 336 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 1500 2982.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Processes:
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe Token: 33 996 server.exe Token: SeIncBasePriorityPrivilege 996 server.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe2982.exeserver.exedescription pid process target process PID 336 wrote to memory of 1500 336 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 2982.exe PID 336 wrote to memory of 1500 336 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 2982.exe PID 336 wrote to memory of 1500 336 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 2982.exe PID 336 wrote to memory of 1500 336 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe 2982.exe PID 1500 wrote to memory of 996 1500 2982.exe server.exe PID 1500 wrote to memory of 996 1500 2982.exe server.exe PID 1500 wrote to memory of 996 1500 2982.exe server.exe PID 1500 wrote to memory of 996 1500 2982.exe server.exe PID 996 wrote to memory of 1712 996 server.exe netsh.exe PID 996 wrote to memory of 1712 996 server.exe netsh.exe PID 996 wrote to memory of 1712 996 server.exe netsh.exe PID 996 wrote to memory of 1712 996 server.exe netsh.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe"C:\Users\Admin\AppData\Local\Temp\2f95f95b19cea5951ebd8ec19f46e8178f427702fc9193d0f851d65a1488a18f.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\2982\2982.exe"C:\Users\Admin\AppData\Local\Temp\2982\2982.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2982\2982.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
C:\Users\Admin\AppData\Local\Temp\2982\2982.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
C:\Users\Admin\AppData\Local\Temp\server.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
C:\Users\Admin\AppData\Local\Temp\server.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
\Users\Admin\AppData\Local\Temp\2982\2982.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
\Users\Admin\AppData\Local\Temp\2982\2982.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
\Users\Admin\AppData\Local\Temp\2982\2982.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
\Users\Admin\AppData\Local\Temp\server.exeMD5
7d2b36fc0b2bceb385763f409d3a8bbf
SHA1c4e0ae7f40f08bce86d8af752debc0f0f2d32874
SHA2565c7e89ac219880e2bf1906d071e1fba266b8b138cd3e32dd3f7807d959e5f166
SHA512b53f8670b06014f40f68931552c7aa5a877502ba707f770e92f2188341932b9e4bfc58c538404660c6e962366e72dee2039f5d8101fa3fb543158d45dad3e70f
-
memory/336-2-0x00000000753E1000-0x00000000753E3000-memory.dmpFilesize
8KB
-
memory/996-12-0x0000000000000000-mapping.dmp
-
memory/996-16-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1500-10-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/1500-6-0x0000000000000000-mapping.dmp
-
memory/1712-17-0x0000000000000000-mapping.dmp