Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
06-10-2021 04:29
Behavioral task
behavioral1
Sample
216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe
Resource
win10-en-20210920
General
-
Target
216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe
-
Size
78KB
-
MD5
495ac365075583f4cbd9487cb6c1935c
-
SHA1
9341e99733e753a7f5c2a716c35a7dc131d271d0
-
SHA256
216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3
-
SHA512
b9e4c72fd53b5e257d701f123fcc6771013b897aa65bbc6f24b1754e9cd9488cde99eb33b54c40b23c76a4bdb669e388b28829b473b00ff0a44940497c46fbe7
Malware Config
Extracted
njrat
0.7.3
Zombie
0.tcp.eu.ngrok.io:14618
svchost.exe
-
reg_key
svchost.exe
-
splitter
123
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exepid process 780 svchost.exe 3192 svchost.exe 4476 svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\svchost.exe\" .." svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4068 schtasks.exe 4036 schtasks.exe 3212 schtasks.exe 3100 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe Token: 33 780 svchost.exe Token: SeIncBasePriorityPrivilege 780 svchost.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exesvchost.exesvchost.exesvchost.exedescription pid process target process PID 3716 wrote to memory of 3516 3716 216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe schtasks.exe PID 3716 wrote to memory of 3516 3716 216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe schtasks.exe PID 3716 wrote to memory of 3516 3716 216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe schtasks.exe PID 3716 wrote to memory of 4068 3716 216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe schtasks.exe PID 3716 wrote to memory of 4068 3716 216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe schtasks.exe PID 3716 wrote to memory of 4068 3716 216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe schtasks.exe PID 3716 wrote to memory of 780 3716 216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe svchost.exe PID 3716 wrote to memory of 780 3716 216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe svchost.exe PID 3716 wrote to memory of 780 3716 216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe svchost.exe PID 780 wrote to memory of 4272 780 svchost.exe schtasks.exe PID 780 wrote to memory of 4272 780 svchost.exe schtasks.exe PID 780 wrote to memory of 4272 780 svchost.exe schtasks.exe PID 780 wrote to memory of 4036 780 svchost.exe schtasks.exe PID 780 wrote to memory of 4036 780 svchost.exe schtasks.exe PID 780 wrote to memory of 4036 780 svchost.exe schtasks.exe PID 3192 wrote to memory of 1836 3192 svchost.exe schtasks.exe PID 3192 wrote to memory of 1836 3192 svchost.exe schtasks.exe PID 3192 wrote to memory of 1836 3192 svchost.exe schtasks.exe PID 3192 wrote to memory of 3212 3192 svchost.exe schtasks.exe PID 3192 wrote to memory of 3212 3192 svchost.exe schtasks.exe PID 3192 wrote to memory of 3212 3192 svchost.exe schtasks.exe PID 4476 wrote to memory of 4644 4476 svchost.exe schtasks.exe PID 4476 wrote to memory of 4644 4476 svchost.exe schtasks.exe PID 4476 wrote to memory of 4644 4476 svchost.exe schtasks.exe PID 4476 wrote to memory of 3100 4476 svchost.exe schtasks.exe PID 4476 wrote to memory of 3100 4476 svchost.exe schtasks.exe PID 4476 wrote to memory of 3100 4476 svchost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe"C:\Users\Admin\AppData\Local\Temp\216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
-
C:\Users\Admin\svchost.exe"C:\Users\Admin\svchost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\svchost.exe" /sc minute /mo 13⤵
- Creates scheduled task(s)
-
C:\Users\Admin\svchost.exeC:\Users\Admin\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\svchost.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
-
C:\Users\Admin\svchost.exeC:\Users\Admin\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\svchost.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svchost.exe.logMD5
6b062b48db9a8e149e10fefd80ab54ef
SHA11e72855f88c33b6ddce512b079bbe2e4aa2b6b57
SHA256026518c621aa1e908fd3617fe1d684a6225393659345ad4f9c085fc4f6b3cf43
SHA512b36007e2b0b71247979cdac1b17520cc37065c001464b4c70d642c8a059510d28ed8b57b7e4df59a43d99d69c588c1bab7b3c95c6a75c0ab98317246b56f7832
-
C:\Users\Admin\svchost.exeMD5
495ac365075583f4cbd9487cb6c1935c
SHA19341e99733e753a7f5c2a716c35a7dc131d271d0
SHA256216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3
SHA512b9e4c72fd53b5e257d701f123fcc6771013b897aa65bbc6f24b1754e9cd9488cde99eb33b54c40b23c76a4bdb669e388b28829b473b00ff0a44940497c46fbe7
-
C:\Users\Admin\svchost.exeMD5
495ac365075583f4cbd9487cb6c1935c
SHA19341e99733e753a7f5c2a716c35a7dc131d271d0
SHA256216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3
SHA512b9e4c72fd53b5e257d701f123fcc6771013b897aa65bbc6f24b1754e9cd9488cde99eb33b54c40b23c76a4bdb669e388b28829b473b00ff0a44940497c46fbe7
-
C:\Users\Admin\svchost.exeMD5
495ac365075583f4cbd9487cb6c1935c
SHA19341e99733e753a7f5c2a716c35a7dc131d271d0
SHA256216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3
SHA512b9e4c72fd53b5e257d701f123fcc6771013b897aa65bbc6f24b1754e9cd9488cde99eb33b54c40b23c76a4bdb669e388b28829b473b00ff0a44940497c46fbe7
-
C:\Users\Admin\svchost.exeMD5
495ac365075583f4cbd9487cb6c1935c
SHA19341e99733e753a7f5c2a716c35a7dc131d271d0
SHA256216500f3e56a76a59f81e3082a38957482f176c6aaf16ae494db8d2fb5e044d3
SHA512b9e4c72fd53b5e257d701f123fcc6771013b897aa65bbc6f24b1754e9cd9488cde99eb33b54c40b23c76a4bdb669e388b28829b473b00ff0a44940497c46fbe7
-
memory/780-123-0x0000000003001000-0x0000000003002000-memory.dmpFilesize
4KB
-
memory/780-118-0x0000000000000000-mapping.dmp
-
memory/1836-125-0x0000000000000000-mapping.dmp
-
memory/3100-131-0x0000000000000000-mapping.dmp
-
memory/3192-127-0x0000000003001000-0x0000000003002000-memory.dmpFilesize
4KB
-
memory/3212-126-0x0000000000000000-mapping.dmp
-
memory/3516-115-0x0000000000000000-mapping.dmp
-
memory/3716-117-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/4036-122-0x0000000000000000-mapping.dmp
-
memory/4068-116-0x0000000000000000-mapping.dmp
-
memory/4272-121-0x0000000000000000-mapping.dmp
-
memory/4476-132-0x0000000003101000-0x0000000003102000-memory.dmpFilesize
4KB
-
memory/4644-130-0x0000000000000000-mapping.dmp