Analysis
-
max time kernel
155s -
max time network
191s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 06:14
Static task
static1
Behavioral task
behavioral1
Sample
62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe
Resource
win10-en-20210920
General
-
Target
62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe
-
Size
55KB
-
MD5
c88342b7f4b583c47b42dc05640b4056
-
SHA1
7be1282dcf2ef52f83532eb25217c66ed7084aa5
-
SHA256
62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59
-
SHA512
495084793684e208097aa1029b0875f83f57b0187b9bdd11acc99a5028d143c36314ff95796195b453b7558bd58ef99541c516fba61981b08afa739c033fb08c
Malware Config
Extracted
njrat
0.7d
@ HaCkInG By Dr WeSt @
w187.ddns.net:2020
4ef9538b5a577a1bd3c1a578ea50c133
-
reg_key
4ef9538b5a577a1bd3c1a578ea50c133
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
[Mr.Abu Hani].exeWindows Audio Device Graph Isolation .exepid process 2040 [Mr.Abu Hani].exe 1752 Windows Audio Device Graph Isolation .exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
Windows Audio Device Graph Isolation .exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4ef9538b5a577a1bd3c1a578ea50c133.exe Windows Audio Device Graph Isolation .exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4ef9538b5a577a1bd3c1a578ea50c133.exe Windows Audio Device Graph Isolation .exe -
Loads dropped DLL 4 IoCs
Processes:
62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe[Mr.Abu Hani].exepid process 1660 62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe 1660 62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe 2040 [Mr.Abu Hani].exe 2040 [Mr.Abu Hani].exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
Windows Audio Device Graph Isolation .exedescription pid process Token: SeDebugPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe Token: 33 1752 Windows Audio Device Graph Isolation .exe Token: SeIncBasePriorityPrivilege 1752 Windows Audio Device Graph Isolation .exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe[Mr.Abu Hani].exeWindows Audio Device Graph Isolation .exedescription pid process target process PID 1660 wrote to memory of 2040 1660 62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe [Mr.Abu Hani].exe PID 1660 wrote to memory of 2040 1660 62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe [Mr.Abu Hani].exe PID 1660 wrote to memory of 2040 1660 62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe [Mr.Abu Hani].exe PID 1660 wrote to memory of 2040 1660 62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe [Mr.Abu Hani].exe PID 2040 wrote to memory of 1752 2040 [Mr.Abu Hani].exe Windows Audio Device Graph Isolation .exe PID 2040 wrote to memory of 1752 2040 [Mr.Abu Hani].exe Windows Audio Device Graph Isolation .exe PID 2040 wrote to memory of 1752 2040 [Mr.Abu Hani].exe Windows Audio Device Graph Isolation .exe PID 2040 wrote to memory of 1752 2040 [Mr.Abu Hani].exe Windows Audio Device Graph Isolation .exe PID 1752 wrote to memory of 1044 1752 Windows Audio Device Graph Isolation .exe netsh.exe PID 1752 wrote to memory of 1044 1752 Windows Audio Device Graph Isolation .exe netsh.exe PID 1752 wrote to memory of 1044 1752 Windows Audio Device Graph Isolation .exe netsh.exe PID 1752 wrote to memory of 1044 1752 Windows Audio Device Graph Isolation .exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe"C:\Users\Admin\AppData\Local\Temp\62cc0a6c49abdef2906b8d9ebb2f60605ca5755d04d187e0b41682de13767e59.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exe"C:\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe"C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe"3⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exe" "Windows Audio Device Graph Isolation .exe" ENABLE4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exeMD5
1b6071dc1c6ca35c780dc5dcf5392ba3
SHA1c331def6c09f8c82bc71826b9df035e8fcc5059d
SHA25689a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721
SHA5127b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56
-
C:\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exeMD5
1b6071dc1c6ca35c780dc5dcf5392ba3
SHA1c331def6c09f8c82bc71826b9df035e8fcc5059d
SHA25689a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721
SHA5127b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56
-
C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exeMD5
1b6071dc1c6ca35c780dc5dcf5392ba3
SHA1c331def6c09f8c82bc71826b9df035e8fcc5059d
SHA25689a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721
SHA5127b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56
-
C:\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exeMD5
1b6071dc1c6ca35c780dc5dcf5392ba3
SHA1c331def6c09f8c82bc71826b9df035e8fcc5059d
SHA25689a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721
SHA5127b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56
-
\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exeMD5
1b6071dc1c6ca35c780dc5dcf5392ba3
SHA1c331def6c09f8c82bc71826b9df035e8fcc5059d
SHA25689a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721
SHA5127b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56
-
\Users\Admin\AppData\Local\Temp\[Mr.Abu Hani].exeMD5
1b6071dc1c6ca35c780dc5dcf5392ba3
SHA1c331def6c09f8c82bc71826b9df035e8fcc5059d
SHA25689a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721
SHA5127b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56
-
\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exeMD5
1b6071dc1c6ca35c780dc5dcf5392ba3
SHA1c331def6c09f8c82bc71826b9df035e8fcc5059d
SHA25689a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721
SHA5127b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56
-
\Users\Admin\AppData\Roaming\Windows Audio Device Graph Isolation .exeMD5
1b6071dc1c6ca35c780dc5dcf5392ba3
SHA1c331def6c09f8c82bc71826b9df035e8fcc5059d
SHA25689a5182594c48407f4588d196d1a22dbed83f4a01023a9e5f6730f5b318ff721
SHA5127b5d03b817025b423d0331a73bd32bb5ec2b5a6fa16bbf40c58695ee193c7dad66187b1574cadd59259799a6c80eabe4031e7d2ea9b22c9333c772d6e4b47c56
-
memory/1044-78-0x0000000000000000-mapping.dmp
-
memory/1660-60-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1660-63-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/1660-62-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1752-77-0x0000000002080000-0x0000000002081000-memory.dmpFilesize
4KB
-
memory/1752-73-0x0000000000000000-mapping.dmp
-
memory/2040-66-0x0000000000000000-mapping.dmp
-
memory/2040-70-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB