Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30-09-2021 13:07
Static task
static1
Behavioral task
behavioral1
Sample
3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe
Resource
win10v20210408
General
-
Target
3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe
-
Size
136KB
-
MD5
359a08045b66fe5f71fde43f9a6db01b
-
SHA1
4580e9f5becff35c4c4e773931d18f2df166d9fc
-
SHA256
3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67
-
SHA512
81b120f81da9b442cb008093b54893d44dad911caffc1008c7de792e1420e1bedc15deb616f745e807410f47db3c049a316a77ffe42bef6959359f39af841683
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:5552
279f6960ed84a752570aca7fb2dc1552
-
reg_key
279f6960ed84a752570aca7fb2dc1552
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
server.exeserver.exepid process 1784 server.exe 2032 server.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 3 IoCs
Processes:
3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exeserver.exepid process 1632 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 1632 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 1784 server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\279f6960ed84a752570aca7fb2dc1552 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exeserver.exedescription pid process target process PID 1100 set thread context of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1784 set thread context of 2032 1784 server.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe Token: 33 2032 server.exe Token: SeIncBasePriorityPrivilege 2032 server.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exeserver.exeserver.exedescription pid process target process PID 1100 wrote to memory of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1100 wrote to memory of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1100 wrote to memory of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1100 wrote to memory of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1100 wrote to memory of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1100 wrote to memory of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1100 wrote to memory of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1100 wrote to memory of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1100 wrote to memory of 1632 1100 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe PID 1632 wrote to memory of 1784 1632 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe server.exe PID 1632 wrote to memory of 1784 1632 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe server.exe PID 1632 wrote to memory of 1784 1632 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe server.exe PID 1632 wrote to memory of 1784 1632 3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe server.exe PID 1784 wrote to memory of 2032 1784 server.exe server.exe PID 1784 wrote to memory of 2032 1784 server.exe server.exe PID 1784 wrote to memory of 2032 1784 server.exe server.exe PID 1784 wrote to memory of 2032 1784 server.exe server.exe PID 1784 wrote to memory of 2032 1784 server.exe server.exe PID 1784 wrote to memory of 2032 1784 server.exe server.exe PID 1784 wrote to memory of 2032 1784 server.exe server.exe PID 1784 wrote to memory of 2032 1784 server.exe server.exe PID 1784 wrote to memory of 2032 1784 server.exe server.exe PID 2032 wrote to memory of 1248 2032 server.exe netsh.exe PID 2032 wrote to memory of 1248 2032 server.exe netsh.exe PID 2032 wrote to memory of 1248 2032 server.exe netsh.exe PID 2032 wrote to memory of 1248 2032 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe"C:\Users\Admin\AppData\Local\Temp\3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe"C:\Users\Admin\AppData\Local\Temp\3de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\server.exeMD5
359a08045b66fe5f71fde43f9a6db01b
SHA14580e9f5becff35c4c4e773931d18f2df166d9fc
SHA2563de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67
SHA51281b120f81da9b442cb008093b54893d44dad911caffc1008c7de792e1420e1bedc15deb616f745e807410f47db3c049a316a77ffe42bef6959359f39af841683
-
C:\Users\Admin\AppData\Local\Temp\server.exeMD5
359a08045b66fe5f71fde43f9a6db01b
SHA14580e9f5becff35c4c4e773931d18f2df166d9fc
SHA2563de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67
SHA51281b120f81da9b442cb008093b54893d44dad911caffc1008c7de792e1420e1bedc15deb616f745e807410f47db3c049a316a77ffe42bef6959359f39af841683
-
C:\Users\Admin\AppData\Local\Temp\server.exeMD5
359a08045b66fe5f71fde43f9a6db01b
SHA14580e9f5becff35c4c4e773931d18f2df166d9fc
SHA2563de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67
SHA51281b120f81da9b442cb008093b54893d44dad911caffc1008c7de792e1420e1bedc15deb616f745e807410f47db3c049a316a77ffe42bef6959359f39af841683
-
\Users\Admin\AppData\Local\Temp\server.exeMD5
359a08045b66fe5f71fde43f9a6db01b
SHA14580e9f5becff35c4c4e773931d18f2df166d9fc
SHA2563de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67
SHA51281b120f81da9b442cb008093b54893d44dad911caffc1008c7de792e1420e1bedc15deb616f745e807410f47db3c049a316a77ffe42bef6959359f39af841683
-
\Users\Admin\AppData\Local\Temp\server.exeMD5
359a08045b66fe5f71fde43f9a6db01b
SHA14580e9f5becff35c4c4e773931d18f2df166d9fc
SHA2563de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67
SHA51281b120f81da9b442cb008093b54893d44dad911caffc1008c7de792e1420e1bedc15deb616f745e807410f47db3c049a316a77ffe42bef6959359f39af841683
-
\Users\Admin\AppData\Local\Temp\server.exeMD5
359a08045b66fe5f71fde43f9a6db01b
SHA14580e9f5becff35c4c4e773931d18f2df166d9fc
SHA2563de70e8b308469f55fafddb2e107d3ae908005e1445eb5d1b09a7ff690f62c67
SHA51281b120f81da9b442cb008093b54893d44dad911caffc1008c7de792e1420e1bedc15deb616f745e807410f47db3c049a316a77ffe42bef6959359f39af841683
-
memory/1100-64-0x0000000002130000-0x0000000002131000-memory.dmpFilesize
4KB
-
memory/1100-60-0x0000000075AF1000-0x0000000075AF3000-memory.dmpFilesize
8KB
-
memory/1248-79-0x0000000000000000-mapping.dmp
-
memory/1632-65-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/1632-62-0x000000000040747E-mapping.dmp
-
memory/1632-61-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1784-68-0x0000000000000000-mapping.dmp
-
memory/1784-77-0x00000000020C0000-0x00000000020C1000-memory.dmpFilesize
4KB
-
memory/2032-74-0x000000000040747E-mapping.dmp
-
memory/2032-78-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB