Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
30-10-2021 20:36
Behavioral task
behavioral1
Sample
ee0385983682322efe022225fb874aca.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
ee0385983682322efe022225fb874aca.exe
Resource
win10-en-20210920
General
-
Target
ee0385983682322efe022225fb874aca.exe
-
Size
37KB
-
MD5
ee0385983682322efe022225fb874aca
-
SHA1
e234165631472c98a62107356a2b55a8e9f8b5a1
-
SHA256
5fa5bb5bf065b701ecbbbd704e302ca70eff2912cee39fd86f2b732372eb44f3
-
SHA512
b72cf0802d84874b1a8101793694a25051ef8460383d73a02552fe4e945517f7c40b7654fcc7b864985bd49d3b1a5e33792625c6483e7e3be6dfe9b909a424c9
Malware Config
Extracted
njrat
im523
HacKed
4.tcp.ngrok.io:12516
004af031f7d2d163aaa3cb0e51c1f6fe
-
reg_key
004af031f7d2d163aaa3cb0e51c1f6fe
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 868 server.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\004af031f7d2d163aaa3cb0e51c1f6fe.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\004af031f7d2d163aaa3cb0e51c1f6fe.exe server.exe -
Loads dropped DLL 1 IoCs
Processes:
ee0385983682322efe022225fb874aca.exepid process 1792 ee0385983682322efe022225fb874aca.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\004af031f7d2d163aaa3cb0e51c1f6fe = "\"C:\\ProgramData\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\004af031f7d2d163aaa3cb0e51c1f6fe = "\"C:\\ProgramData\\server.exe\" .." server.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1828 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
server.exepid process 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe 868 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
server.exepid process 868 server.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
server.exetaskkill.exedescription pid process Token: SeDebugPrivilege 868 server.exe Token: SeDebugPrivilege 1828 taskkill.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe Token: 33 868 server.exe Token: SeIncBasePriorityPrivilege 868 server.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ee0385983682322efe022225fb874aca.exeserver.exedescription pid process target process PID 1792 wrote to memory of 868 1792 ee0385983682322efe022225fb874aca.exe server.exe PID 1792 wrote to memory of 868 1792 ee0385983682322efe022225fb874aca.exe server.exe PID 1792 wrote to memory of 868 1792 ee0385983682322efe022225fb874aca.exe server.exe PID 1792 wrote to memory of 868 1792 ee0385983682322efe022225fb874aca.exe server.exe PID 868 wrote to memory of 912 868 server.exe netsh.exe PID 868 wrote to memory of 912 868 server.exe netsh.exe PID 868 wrote to memory of 912 868 server.exe netsh.exe PID 868 wrote to memory of 912 868 server.exe netsh.exe PID 868 wrote to memory of 1828 868 server.exe taskkill.exe PID 868 wrote to memory of 1828 868 server.exe taskkill.exe PID 868 wrote to memory of 1828 868 server.exe taskkill.exe PID 868 wrote to memory of 1828 868 server.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0385983682322efe022225fb874aca.exe"C:\Users\Admin\AppData\Local\Temp\ee0385983682322efe022225fb874aca.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\server.exe"C:\ProgramData\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\server.exe" "server.exe" ENABLE3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\server.exeMD5
ee0385983682322efe022225fb874aca
SHA1e234165631472c98a62107356a2b55a8e9f8b5a1
SHA2565fa5bb5bf065b701ecbbbd704e302ca70eff2912cee39fd86f2b732372eb44f3
SHA512b72cf0802d84874b1a8101793694a25051ef8460383d73a02552fe4e945517f7c40b7654fcc7b864985bd49d3b1a5e33792625c6483e7e3be6dfe9b909a424c9
-
C:\ProgramData\server.exeMD5
ee0385983682322efe022225fb874aca
SHA1e234165631472c98a62107356a2b55a8e9f8b5a1
SHA2565fa5bb5bf065b701ecbbbd704e302ca70eff2912cee39fd86f2b732372eb44f3
SHA512b72cf0802d84874b1a8101793694a25051ef8460383d73a02552fe4e945517f7c40b7654fcc7b864985bd49d3b1a5e33792625c6483e7e3be6dfe9b909a424c9
-
\ProgramData\server.exeMD5
ee0385983682322efe022225fb874aca
SHA1e234165631472c98a62107356a2b55a8e9f8b5a1
SHA2565fa5bb5bf065b701ecbbbd704e302ca70eff2912cee39fd86f2b732372eb44f3
SHA512b72cf0802d84874b1a8101793694a25051ef8460383d73a02552fe4e945517f7c40b7654fcc7b864985bd49d3b1a5e33792625c6483e7e3be6dfe9b909a424c9
-
memory/868-58-0x0000000000000000-mapping.dmp
-
memory/868-62-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/912-63-0x0000000000000000-mapping.dmp
-
memory/1792-55-0x0000000074A31000-0x0000000074A33000-memory.dmpFilesize
8KB
-
memory/1792-56-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/1828-64-0x0000000000000000-mapping.dmp