Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
24-09-2021 06:12
Static task
static1
Behavioral task
behavioral1
Sample
1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe
Resource
win10-en-20210920
General
-
Target
1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe
-
Size
152KB
-
MD5
c2b9c99086b64ed5ef6ae1bd34288013
-
SHA1
43a4fdff438bb03812aaf9cf273c5021a21623f8
-
SHA256
1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f
-
SHA512
7e2595d992653ba5b332514379ab2ea8aca86eefbe6c89f3970a3ea5c36f1922d88dda3341f269a5754fd4b87e0a3ed9eca1a79b6ee16c8482741401d0087391
Malware Config
Extracted
njrat
v2.0
HacKed
daddygvgv.ddns.net:1177
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
MFhYi.exeMFhYi.exePayload.exepid process 1352 MFhYi.exe 1544 MFhYi.exe 652 Payload.exe -
Drops startup file 3 IoCs
Processes:
MFhYi.exeMFhYi.exePayload.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk MFhYi.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk MFhYi.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Payload.exe -
Loads dropped DLL 1 IoCs
Processes:
MFhYi.exepid process 1544 MFhYi.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MFhYi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Payload.exe" MFhYi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exePayload.exedescription pid process Token: SeDebugPrivilege 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe Token: SeDebugPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe Token: 33 652 Payload.exe Token: SeIncBasePriorityPrivilege 652 Payload.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exeMFhYi.exedescription pid process target process PID 2032 wrote to memory of 1352 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1352 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1352 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1352 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1544 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1544 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1544 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 2032 wrote to memory of 1544 2032 1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe MFhYi.exe PID 1544 wrote to memory of 652 1544 MFhYi.exe Payload.exe PID 1544 wrote to memory of 652 1544 MFhYi.exe Payload.exe PID 1544 wrote to memory of 652 1544 MFhYi.exe Payload.exe PID 1544 wrote to memory of 652 1544 MFhYi.exe Payload.exe PID 1544 wrote to memory of 860 1544 MFhYi.exe attrib.exe PID 1544 wrote to memory of 860 1544 MFhYi.exe attrib.exe PID 1544 wrote to memory of 860 1544 MFhYi.exe attrib.exe PID 1544 wrote to memory of 860 1544 MFhYi.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe"C:\Users\Admin\AppData\Local\Temp\1ca2fa1eacf168c97e2663f7bbbe64afe6569ade725ed84f4ee1fe91aa27e83f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exe"C:\Users\Admin\AppData\Local\Temp\MFhYi.exe"2⤵
- Executes dropped EXE
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exe"C:\Users\Admin\AppData\Local\Temp\MFhYi.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Payload.exe"C:\Users\Admin\AppData\Roaming\Payload.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Payload.exe"3⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exeMD5
8e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exeMD5
8e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
C:\Users\Admin\AppData\Local\Temp\MFhYi.exeMD5
8e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnkMD5
b9622246a2ed61171999ee678f6cc470
SHA1947ec795fbe97ce8c9b4622b456353716faceefa
SHA256bb8e11992d8f89c50638b95705372a1d5d136784844ccdb98e44ceb79af96056
SHA512102f07473a2ee840f197e8279042b7e5f591d85d238d8ed8a11309f9ed3a6b7f54771a9d163b326ac74f7ac7f411d1114f42e938599ce4d11caaf3cd4b881d1e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnkMD5
f6cb7b462491f3bd6758b9848a25fa09
SHA113875fca8b81fcc40cff20a9337d04d704adbaac
SHA2568e1c016974f9f54989bacb9ee970508471d3dec83d0938a41c718bee667077df
SHA5123d86c05351743f0ba38e843f4022e2931bede4a273dfd1d257eff420d1329d998f6619209023033d8185743249f0bfd7ff50d0e5cd6bc2b065698aca303727f9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnkMD5
f6cb7b462491f3bd6758b9848a25fa09
SHA113875fca8b81fcc40cff20a9337d04d704adbaac
SHA2568e1c016974f9f54989bacb9ee970508471d3dec83d0938a41c718bee667077df
SHA5123d86c05351743f0ba38e843f4022e2931bede4a273dfd1d257eff420d1329d998f6619209023033d8185743249f0bfd7ff50d0e5cd6bc2b065698aca303727f9
-
C:\Users\Admin\AppData\Roaming\Payload.exeMD5
8e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
C:\Users\Admin\AppData\Roaming\Payload.exeMD5
8e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
\Users\Admin\AppData\Roaming\Payload.exeMD5
8e54875e72bebf23615137805c3d1145
SHA128eb5693c2964c991f2df6bf408c9a394b1db8db
SHA25613070a0ead17f9ace63f7f78f754f8700dc186d3d744463876fb5d5dd4ceea9e
SHA5122387c3150ca8f7473cc0e2d552d0e4b39ac396b363bbd3160284fc434b9d68d4df90afc291900c4f3c685bbccd0e6192fead07d90b0610e8dd028a56719926df
-
memory/652-67-0x0000000000000000-mapping.dmp
-
memory/652-74-0x0000000002130000-0x0000000002131000-memory.dmpFilesize
4KB
-
memory/860-71-0x0000000000000000-mapping.dmp
-
memory/1352-63-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/1352-61-0x00000000759B1000-0x00000000759B3000-memory.dmpFilesize
8KB
-
memory/1352-56-0x0000000000000000-mapping.dmp
-
memory/1544-64-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB
-
memory/1544-58-0x0000000000000000-mapping.dmp
-
memory/2032-54-0x000000013F940000-0x000000013F941000-memory.dmpFilesize
4KB