Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 07:03
Static task
static1
Behavioral task
behavioral1
Sample
b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe
Resource
win10v20201028
General
-
Target
b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe
-
Size
26KB
-
MD5
043335fcd3a8b4b6d85861b9e5c27b74
-
SHA1
567bb55395160fd165bdd6ba17176399cb54bc58
-
SHA256
b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277
-
SHA512
426521fc7888079b97e91a3a4d4b1bcc29f5bc0a914ded979970f3b22c625866c26123ff9f0c6baca85abb5fbd5e9b0d053277402d111b343fc11b87fba93529
Malware Config
Extracted
njrat
0.7d
HacKed
192.168.7.108:1177
017c060db3a2fd47416ea61ee39f9282
-
reg_key
017c060db3a2fd47416ea61ee39f9282
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 2860 server.exe -
Modifies Windows Firewall 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\017c060db3a2fd47416ea61ee39f9282 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\017c060db3a2fd47416ea61ee39f9282 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe Token: 33 2860 server.exe Token: SeIncBasePriorityPrivilege 2860 server.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exeserver.exedescription pid process target process PID 508 wrote to memory of 2860 508 b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe server.exe PID 508 wrote to memory of 2860 508 b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe server.exe PID 2860 wrote to memory of 196 2860 server.exe netsh.exe PID 2860 wrote to memory of 196 2860 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe"C:\Users\Admin\AppData\Local\Temp\b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\server.exeMD5
043335fcd3a8b4b6d85861b9e5c27b74
SHA1567bb55395160fd165bdd6ba17176399cb54bc58
SHA256b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277
SHA512426521fc7888079b97e91a3a4d4b1bcc29f5bc0a914ded979970f3b22c625866c26123ff9f0c6baca85abb5fbd5e9b0d053277402d111b343fc11b87fba93529
-
C:\Users\Admin\AppData\Local\Temp\server.exeMD5
043335fcd3a8b4b6d85861b9e5c27b74
SHA1567bb55395160fd165bdd6ba17176399cb54bc58
SHA256b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277
SHA512426521fc7888079b97e91a3a4d4b1bcc29f5bc0a914ded979970f3b22c625866c26123ff9f0c6baca85abb5fbd5e9b0d053277402d111b343fc11b87fba93529
-
memory/196-15-0x0000000000000000-mapping.dmp
-
memory/508-2-0x00007FF809F60000-0x00007FF80A94C000-memory.dmpFilesize
9.9MB
-
memory/508-3-0x0000025003B00000-0x0000025003B01000-memory.dmpFilesize
4KB
-
memory/508-5-0x0000025003F90000-0x0000025003F96000-memory.dmpFilesize
24KB
-
memory/508-6-0x00000250055F0000-0x00000250055F2000-memory.dmpFilesize
8KB
-
memory/2860-7-0x0000000000000000-mapping.dmp
-
memory/2860-10-0x00007FF809F60000-0x00007FF80A94C000-memory.dmpFilesize
9.9MB
-
memory/2860-14-0x0000026EDE240000-0x0000026EDE242000-memory.dmpFilesize
8KB