Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
30-10-2021 20:36
Behavioral task
behavioral1
Sample
ee0385983682322efe022225fb874aca.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
ee0385983682322efe022225fb874aca.exe
Resource
win10-en-20210920
General
-
Target
ee0385983682322efe022225fb874aca.exe
-
Size
37KB
-
MD5
ee0385983682322efe022225fb874aca
-
SHA1
e234165631472c98a62107356a2b55a8e9f8b5a1
-
SHA256
5fa5bb5bf065b701ecbbbd704e302ca70eff2912cee39fd86f2b732372eb44f3
-
SHA512
b72cf0802d84874b1a8101793694a25051ef8460383d73a02552fe4e945517f7c40b7654fcc7b864985bd49d3b1a5e33792625c6483e7e3be6dfe9b909a424c9
Malware Config
Extracted
njrat
im523
HacKed
4.tcp.ngrok.io:12516
004af031f7d2d163aaa3cb0e51c1f6fe
-
reg_key
004af031f7d2d163aaa3cb0e51c1f6fe
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 636 server.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\004af031f7d2d163aaa3cb0e51c1f6fe.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\004af031f7d2d163aaa3cb0e51c1f6fe.exe server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\004af031f7d2d163aaa3cb0e51c1f6fe = "\"C:\\ProgramData\\server.exe\" .." server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\004af031f7d2d163aaa3cb0e51c1f6fe = "\"C:\\ProgramData\\server.exe\" .." server.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 892 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
server.exepid process 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe 636 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
server.exepid process 636 server.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
server.exetaskkill.exedescription pid process Token: SeDebugPrivilege 636 server.exe Token: SeDebugPrivilege 892 taskkill.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe Token: 33 636 server.exe Token: SeIncBasePriorityPrivilege 636 server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ee0385983682322efe022225fb874aca.exeserver.exedescription pid process target process PID 3256 wrote to memory of 636 3256 ee0385983682322efe022225fb874aca.exe server.exe PID 3256 wrote to memory of 636 3256 ee0385983682322efe022225fb874aca.exe server.exe PID 3256 wrote to memory of 636 3256 ee0385983682322efe022225fb874aca.exe server.exe PID 636 wrote to memory of 1920 636 server.exe netsh.exe PID 636 wrote to memory of 1920 636 server.exe netsh.exe PID 636 wrote to memory of 1920 636 server.exe netsh.exe PID 636 wrote to memory of 892 636 server.exe taskkill.exe PID 636 wrote to memory of 892 636 server.exe taskkill.exe PID 636 wrote to memory of 892 636 server.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0385983682322efe022225fb874aca.exe"C:\Users\Admin\AppData\Local\Temp\ee0385983682322efe022225fb874aca.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\server.exe"C:\ProgramData\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\server.exe" "server.exe" ENABLE3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\server.exeMD5
ee0385983682322efe022225fb874aca
SHA1e234165631472c98a62107356a2b55a8e9f8b5a1
SHA2565fa5bb5bf065b701ecbbbd704e302ca70eff2912cee39fd86f2b732372eb44f3
SHA512b72cf0802d84874b1a8101793694a25051ef8460383d73a02552fe4e945517f7c40b7654fcc7b864985bd49d3b1a5e33792625c6483e7e3be6dfe9b909a424c9
-
C:\ProgramData\server.exeMD5
ee0385983682322efe022225fb874aca
SHA1e234165631472c98a62107356a2b55a8e9f8b5a1
SHA2565fa5bb5bf065b701ecbbbd704e302ca70eff2912cee39fd86f2b732372eb44f3
SHA512b72cf0802d84874b1a8101793694a25051ef8460383d73a02552fe4e945517f7c40b7654fcc7b864985bd49d3b1a5e33792625c6483e7e3be6dfe9b909a424c9
-
memory/636-116-0x0000000000000000-mapping.dmp
-
memory/636-119-0x0000000002CD0000-0x0000000002CD1000-memory.dmpFilesize
4KB
-
memory/892-121-0x0000000000000000-mapping.dmp
-
memory/1920-120-0x0000000000000000-mapping.dmp
-
memory/3256-115-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB