Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
01-11-2021 10:56
Static task
static1
Behavioral task
behavioral1
Sample
a73c12e9bb944ca7494ac845ee87db2e.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
a73c12e9bb944ca7494ac845ee87db2e.exe
Resource
win10-en-20210920
General
-
Target
a73c12e9bb944ca7494ac845ee87db2e.exe
-
Size
92KB
-
MD5
a73c12e9bb944ca7494ac845ee87db2e
-
SHA1
20ea37ae6b6b6cf15edc65bf200cde2a2b47d2a2
-
SHA256
0e24d40828ef4582c2571e175e9f1c59e1484fa926cffe18b1a4547f6ee2781a
-
SHA512
c89e78e08f97f6399d92a71efb489d998b2089bae74f26555f569e21440561fea64956370d8b881e3c8729f20ddc466c6821f5529cbc3a205b0700ba93f47bd5
Malware Config
Extracted
njrat
0.7d
HacKed
203.159.92.167:2323
9d38b66479584d90a4d378a84f8e5769
-
reg_key
9d38b66479584d90a4d378a84f8e5769
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 3264 server.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 6 IoCs
Processes:
server.exea73c12e9bb944ca7494ac845ee87db2e.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9d38b66479584d90a4d378a84f8e5769.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a73c12e9bb944ca7494ac845ee87db2e.exe a73c12e9bb944ca7494ac845ee87db2e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a73c12e9bb944ca7494ac845ee87db2e.exe a73c12e9bb944ca7494ac845ee87db2e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\server.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\server.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9d38b66479584d90a4d378a84f8e5769.exe server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9d38b66479584d90a4d378a84f8e5769 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\9d38b66479584d90a4d378a84f8e5769 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1484 schtasks.exe 1200 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a73c12e9bb944ca7494ac845ee87db2e.exeserver.exepid process 4068 a73c12e9bb944ca7494ac845ee87db2e.exe 4068 a73c12e9bb944ca7494ac845ee87db2e.exe 4068 a73c12e9bb944ca7494ac845ee87db2e.exe 4068 a73c12e9bb944ca7494ac845ee87db2e.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe 3264 server.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
a73c12e9bb944ca7494ac845ee87db2e.exeserver.exedescription pid process Token: SeDebugPrivilege 4068 a73c12e9bb944ca7494ac845ee87db2e.exe Token: SeDebugPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe Token: 33 3264 server.exe Token: SeIncBasePriorityPrivilege 3264 server.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a73c12e9bb944ca7494ac845ee87db2e.exeserver.exedescription pid process target process PID 4068 wrote to memory of 1200 4068 a73c12e9bb944ca7494ac845ee87db2e.exe schtasks.exe PID 4068 wrote to memory of 1200 4068 a73c12e9bb944ca7494ac845ee87db2e.exe schtasks.exe PID 4068 wrote to memory of 1200 4068 a73c12e9bb944ca7494ac845ee87db2e.exe schtasks.exe PID 4068 wrote to memory of 3264 4068 a73c12e9bb944ca7494ac845ee87db2e.exe server.exe PID 4068 wrote to memory of 3264 4068 a73c12e9bb944ca7494ac845ee87db2e.exe server.exe PID 4068 wrote to memory of 3264 4068 a73c12e9bb944ca7494ac845ee87db2e.exe server.exe PID 3264 wrote to memory of 1484 3264 server.exe schtasks.exe PID 3264 wrote to memory of 1484 3264 server.exe schtasks.exe PID 3264 wrote to memory of 1484 3264 server.exe schtasks.exe PID 3264 wrote to memory of 772 3264 server.exe netsh.exe PID 3264 wrote to memory of 772 3264 server.exe netsh.exe PID 3264 wrote to memory of 772 3264 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a73c12e9bb944ca7494ac845ee87db2e.exe"C:\Users\Admin\AppData\Local\Temp\a73c12e9bb944ca7494ac845ee87db2e.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "penis" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/a73c12e9bb944ca7494ac845ee87db2e.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "penis" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup/server.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\server.exeMD5
a73c12e9bb944ca7494ac845ee87db2e
SHA120ea37ae6b6b6cf15edc65bf200cde2a2b47d2a2
SHA2560e24d40828ef4582c2571e175e9f1c59e1484fa926cffe18b1a4547f6ee2781a
SHA512c89e78e08f97f6399d92a71efb489d998b2089bae74f26555f569e21440561fea64956370d8b881e3c8729f20ddc466c6821f5529cbc3a205b0700ba93f47bd5
-
C:\Users\Admin\AppData\Roaming\server.exeMD5
a73c12e9bb944ca7494ac845ee87db2e
SHA120ea37ae6b6b6cf15edc65bf200cde2a2b47d2a2
SHA2560e24d40828ef4582c2571e175e9f1c59e1484fa926cffe18b1a4547f6ee2781a
SHA512c89e78e08f97f6399d92a71efb489d998b2089bae74f26555f569e21440561fea64956370d8b881e3c8729f20ddc466c6821f5529cbc3a205b0700ba93f47bd5
-
memory/772-139-0x0000000000000000-mapping.dmp
-
memory/1200-120-0x0000000000000000-mapping.dmp
-
memory/1484-132-0x0000000000000000-mapping.dmp
-
memory/3264-138-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3264-146-0x0000000006224000-0x0000000006227000-memory.dmpFilesize
12KB
-
memory/3264-154-0x0000000006235000-0x0000000006238000-memory.dmpFilesize
12KB
-
memory/3264-124-0x0000000000000000-mapping.dmp
-
memory/3264-153-0x0000000006233000-0x0000000006235000-memory.dmpFilesize
8KB
-
memory/3264-152-0x0000000006231000-0x0000000006233000-memory.dmpFilesize
8KB
-
memory/3264-151-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3264-150-0x0000000006221000-0x0000000006226000-memory.dmpFilesize
20KB
-
memory/3264-149-0x000000000622F000-0x0000000006230000-memory.dmpFilesize
4KB
-
memory/3264-136-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3264-137-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3264-148-0x000000000622C000-0x0000000006231000-memory.dmpFilesize
20KB
-
memory/3264-147-0x0000000006227000-0x000000000622C000-memory.dmpFilesize
20KB
-
memory/3264-140-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3264-141-0x0000000006200000-0x0000000006201000-memory.dmpFilesize
4KB
-
memory/3264-142-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3264-143-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3264-144-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3264-145-0x0000000006220000-0x0000000006224000-memory.dmpFilesize
16KB
-
memory/4068-122-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/4068-117-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/4068-115-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/4068-135-0x0000000004C66000-0x0000000004C67000-memory.dmpFilesize
4KB
-
memory/4068-134-0x0000000004C65000-0x0000000004C66000-memory.dmpFilesize
4KB
-
memory/4068-118-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/4068-119-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/4068-121-0x0000000004FD0000-0x0000000004FD6000-memory.dmpFilesize
24KB
-
memory/4068-123-0x0000000004C63000-0x0000000004C65000-memory.dmpFilesize
8KB