Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en -
submitted
01-09-2021 23:02
Static task
static1
Behavioral task
behavioral1
Sample
5916EAC72F7396EDFF49CAD9DCD8D80C.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
5916EAC72F7396EDFF49CAD9DCD8D80C.exe
Resource
win10-en
General
-
Target
5916EAC72F7396EDFF49CAD9DCD8D80C.exe
-
Size
120KB
-
MD5
5916eac72f7396edff49cad9dcd8d80c
-
SHA1
8e49c5a46c86c239ea314513ef80e0e275541e19
-
SHA256
b13fbd200b38f02c0278e54483e641a2cfb41acd1a90bed78ac8791d0c1cf5b2
-
SHA512
e584db22f6f01714f32061846d4ee26e400889c984aef744a73a66a5f4b1a6bace6906f55b48bb45a7aaa8677f0a51b8aabc9536216632abaa0480983038dff9
Malware Config
Extracted
njrat
v2.0
HacKed
107.152.99.41:54893
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tmpD627.tmpjmboysofpwfkab.exetmpD77F.tmpjihmokkdytlmx.exepid process 4204 tmpD627.tmpjmboysofpwfkab.exe 4352 tmpD77F.tmpjihmokkdytlmx.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 6 IoCs
Processes:
tmpD77F.tmpjihmokkdytlmx.exetmpD627.tmpjmboysofpwfkab.exeattrib.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57fb05ec5f5f4ec817027bcb7278a5fa.exe tmpD77F.tmpjihmokkdytlmx.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe tmpD627.tmpjmboysofpwfkab.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe tmpD627.tmpjmboysofpwfkab.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe attrib.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk tmpD627.tmpjmboysofpwfkab.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57fb05ec5f5f4ec817027bcb7278a5fa.exe tmpD77F.tmpjihmokkdytlmx.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
tmpD627.tmpjmboysofpwfkab.exetmpD77F.tmpjihmokkdytlmx.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" tmpD627.tmpjmboysofpwfkab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" tmpD627.tmpjmboysofpwfkab.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\57fb05ec5f5f4ec817027bcb7278a5fa = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpD77F.tmpjihmokkdytlmx.exe\" .." tmpD77F.tmpjihmokkdytlmx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\57fb05ec5f5f4ec817027bcb7278a5fa = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpD77F.tmpjihmokkdytlmx.exe\" .." tmpD77F.tmpjihmokkdytlmx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" tmpD627.tmpjmboysofpwfkab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" tmpD627.tmpjmboysofpwfkab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tmpD77F.tmpjihmokkdytlmx.exetmpD627.tmpjmboysofpwfkab.exedescription pid process Token: SeDebugPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeDebugPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: 33 4204 tmpD627.tmpjmboysofpwfkab.exe Token: SeIncBasePriorityPrivilege 4204 tmpD627.tmpjmboysofpwfkab.exe Token: 33 4352 tmpD77F.tmpjihmokkdytlmx.exe Token: SeIncBasePriorityPrivilege 4352 tmpD77F.tmpjihmokkdytlmx.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
5916EAC72F7396EDFF49CAD9DCD8D80C.exetmpD77F.tmpjihmokkdytlmx.exetmpD627.tmpjmboysofpwfkab.exedescription pid process target process PID 4732 wrote to memory of 4204 4732 5916EAC72F7396EDFF49CAD9DCD8D80C.exe tmpD627.tmpjmboysofpwfkab.exe PID 4732 wrote to memory of 4204 4732 5916EAC72F7396EDFF49CAD9DCD8D80C.exe tmpD627.tmpjmboysofpwfkab.exe PID 4732 wrote to memory of 4204 4732 5916EAC72F7396EDFF49CAD9DCD8D80C.exe tmpD627.tmpjmboysofpwfkab.exe PID 4732 wrote to memory of 4352 4732 5916EAC72F7396EDFF49CAD9DCD8D80C.exe tmpD77F.tmpjihmokkdytlmx.exe PID 4732 wrote to memory of 4352 4732 5916EAC72F7396EDFF49CAD9DCD8D80C.exe tmpD77F.tmpjihmokkdytlmx.exe PID 4352 wrote to memory of 4476 4352 tmpD77F.tmpjihmokkdytlmx.exe netsh.exe PID 4352 wrote to memory of 4476 4352 tmpD77F.tmpjihmokkdytlmx.exe netsh.exe PID 4204 wrote to memory of 2752 4204 tmpD627.tmpjmboysofpwfkab.exe attrib.exe PID 4204 wrote to memory of 2752 4204 tmpD627.tmpjmboysofpwfkab.exe attrib.exe PID 4204 wrote to memory of 2752 4204 tmpD627.tmpjmboysofpwfkab.exe attrib.exe PID 4204 wrote to memory of 3936 4204 tmpD627.tmpjmboysofpwfkab.exe attrib.exe PID 4204 wrote to memory of 3936 4204 tmpD627.tmpjmboysofpwfkab.exe attrib.exe PID 4204 wrote to memory of 3936 4204 tmpD627.tmpjmboysofpwfkab.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3936 attrib.exe 2752 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5916EAC72F7396EDFF49CAD9DCD8D80C.exe"C:\Users\Admin\AppData\Local\Temp\5916EAC72F7396EDFF49CAD9DCD8D80C.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpD627.tmpjmboysofpwfkab.exe"C:\Users\Admin\AppData\Local\Temp\tmpD627.tmpjmboysofpwfkab.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"3⤵
- Drops startup file
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"3⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\tmpD77F.tmpjihmokkdytlmx.exe"C:\Users\Admin\AppData\Local\Temp\tmpD77F.tmpjihmokkdytlmx.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\tmpD77F.tmpjihmokkdytlmx.exe" "tmpD77F.tmpjihmokkdytlmx.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD627.tmpjmboysofpwfkab.exeMD5
e848c5e3b3e7fb19f0db58fffce478e4
SHA14beade72e7848e21517c2bf4771d27b8dcf7eb48
SHA25653d8b02ff494749adcb4b02524041a9bc3d3cdc2f435904eee48ae318dc211d5
SHA5126492d6aa1707841e32853e251c0bc62e6f55c505d38fc21d96edf2706959f114dab7233d8f2616aaf032cf8ba23f7cf5187d9955cf39bfec574fe37187903f0c
-
C:\Users\Admin\AppData\Local\Temp\tmpD627.tmpjmboysofpwfkab.exeMD5
e848c5e3b3e7fb19f0db58fffce478e4
SHA14beade72e7848e21517c2bf4771d27b8dcf7eb48
SHA25653d8b02ff494749adcb4b02524041a9bc3d3cdc2f435904eee48ae318dc211d5
SHA5126492d6aa1707841e32853e251c0bc62e6f55c505d38fc21d96edf2706959f114dab7233d8f2616aaf032cf8ba23f7cf5187d9955cf39bfec574fe37187903f0c
-
C:\Users\Admin\AppData\Local\Temp\tmpD77F.tmpjihmokkdytlmx.exeMD5
90fe7a4b04c23033119dafdf2851715e
SHA180049ce46d24990862d7010e9392d276d7902b75
SHA2561ab2126c5d97b51dd1f735fdadc31488f2500d37425c7a42fe148dcf95971a07
SHA512c137d8e7d465d22774bdaff7541fea50dde926394260f2668610ce68df3bf441a63114e40ede2391041c6700cf878ad0cba582cfdd9d94504d9deaddea74a08f
-
C:\Users\Admin\AppData\Local\Temp\tmpD77F.tmpjihmokkdytlmx.exeMD5
90fe7a4b04c23033119dafdf2851715e
SHA180049ce46d24990862d7010e9392d276d7902b75
SHA2561ab2126c5d97b51dd1f735fdadc31488f2500d37425c7a42fe148dcf95971a07
SHA512c137d8e7d465d22774bdaff7541fea50dde926394260f2668610ce68df3bf441a63114e40ede2391041c6700cf878ad0cba582cfdd9d94504d9deaddea74a08f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exeMD5
e848c5e3b3e7fb19f0db58fffce478e4
SHA14beade72e7848e21517c2bf4771d27b8dcf7eb48
SHA25653d8b02ff494749adcb4b02524041a9bc3d3cdc2f435904eee48ae318dc211d5
SHA5126492d6aa1707841e32853e251c0bc62e6f55c505d38fc21d96edf2706959f114dab7233d8f2616aaf032cf8ba23f7cf5187d9955cf39bfec574fe37187903f0c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exeMD5
e848c5e3b3e7fb19f0db58fffce478e4
SHA14beade72e7848e21517c2bf4771d27b8dcf7eb48
SHA25653d8b02ff494749adcb4b02524041a9bc3d3cdc2f435904eee48ae318dc211d5
SHA5126492d6aa1707841e32853e251c0bc62e6f55c505d38fc21d96edf2706959f114dab7233d8f2616aaf032cf8ba23f7cf5187d9955cf39bfec574fe37187903f0c
-
memory/2752-126-0x0000000000000000-mapping.dmp
-
memory/3936-127-0x0000000000000000-mapping.dmp
-
memory/4204-117-0x0000000000000000-mapping.dmp
-
memory/4204-130-0x0000000002601000-0x0000000002602000-memory.dmpFilesize
4KB
-
memory/4204-124-0x0000000002600000-0x0000000002601000-memory.dmpFilesize
4KB
-
memory/4352-119-0x0000000000000000-mapping.dmp
-
memory/4352-123-0x00000000021A0000-0x00000000021A2000-memory.dmpFilesize
8KB
-
memory/4476-125-0x0000000000000000-mapping.dmp
-
memory/4732-116-0x0000000002DB0000-0x0000000002DB2000-memory.dmpFilesize
8KB