Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows7_x64 -
resource
win7-en-20210916 -
submitted
16-09-2021 23:00
Static task
static1
Behavioral task
behavioral1
Sample
36ab226ba7a1f5239b52c03164824781.exe
Resource
win7-en-20210916
windows7_x64
0 signatures
0 seconds
General
-
Target
36ab226ba7a1f5239b52c03164824781.exe
-
Size
19KB
-
MD5
36ab226ba7a1f5239b52c03164824781
-
SHA1
390343d76afc548fed43e6f4f01125608ad8774d
-
SHA256
1d24583082fa73349c7c6a4d7a4782c6a87b17cc3bf4df04fb170d707017e944
-
SHA512
1a2839fcd596216409b9c0585f3e55677b7465e738d77a20f2c2c83b7e49b07f99b77422e37951e7a730daf267ad71e4b05a53d144d3d3db674a4a5ffee1c687
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
8000njsept.duckdns.org:8000
Mutex
007d79cbe435
Attributes
-
reg_key
007d79cbe435
-
splitter
@!#&^%$
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
36ab226ba7a1f5239b52c03164824781.exepid process 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
36ab226ba7a1f5239b52c03164824781.exedescription pid process target process PID 600 set thread context of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1716 600 WerFault.exe 36ab226ba7a1f5239b52c03164824781.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
36ab226ba7a1f5239b52c03164824781.exeWerFault.exepid process 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 600 36ab226ba7a1f5239b52c03164824781.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1716 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
36ab226ba7a1f5239b52c03164824781.exeWerFault.exeregsvcs.exedescription pid process Token: SeDebugPrivilege 600 36ab226ba7a1f5239b52c03164824781.exe Token: SeDebugPrivilege 1716 WerFault.exe Token: SeDebugPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe Token: 33 576 regsvcs.exe Token: SeIncBasePriorityPrivilege 576 regsvcs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
36ab226ba7a1f5239b52c03164824781.exedescription pid process target process PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 576 600 36ab226ba7a1f5239b52c03164824781.exe regsvcs.exe PID 600 wrote to memory of 1716 600 36ab226ba7a1f5239b52c03164824781.exe WerFault.exe PID 600 wrote to memory of 1716 600 36ab226ba7a1f5239b52c03164824781.exe WerFault.exe PID 600 wrote to memory of 1716 600 36ab226ba7a1f5239b52c03164824781.exe WerFault.exe PID 600 wrote to memory of 1716 600 36ab226ba7a1f5239b52c03164824781.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36ab226ba7a1f5239b52c03164824781.exe"C:\Users\Admin\AppData\Local\Temp\36ab226ba7a1f5239b52c03164824781.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 16762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-59-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/576-60-0x000000000040676E-mapping.dmp
-
memory/576-61-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/576-65-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/600-54-0x0000000001060000-0x0000000001061000-memory.dmpFilesize
4KB
-
memory/600-56-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/600-57-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/600-58-0x00000000009C0000-0x00000000009DA000-memory.dmpFilesize
104KB
-
memory/1716-63-0x0000000000000000-mapping.dmp
-
memory/1716-64-0x0000000001D70000-0x0000000001D71000-memory.dmpFilesize
4KB