Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
17-11-2021 05:36
Static task
static1
Behavioral task
behavioral1
Sample
PO11557.exe
Resource
win7-en-20211014
General
-
Target
PO11557.exe
-
Size
662KB
-
MD5
51b5e9e7d1d63c1acd6df20dda31004a
-
SHA1
2a935b93c9135bb4d0d849c8219c453075bcdf47
-
SHA256
2c6fae2182c59ef4cee6b63e29cf7fa66990e40ad5c22b6a469d3c935766202c
-
SHA512
f91f54e994b898e96743ece7f61613301d78e398361d10bbd25c0b59e59bd75fe6a438adc8ce4ce20031fa2202d4c7a5239bbbf105aba8619b43717950b6a202
Malware Config
Extracted
njrat
0.7d
HacKed
107.155.132.152:5552
2b9f14c7f031fd1035abf9fa94c773ba
-
reg_key
2b9f14c7f031fd1035abf9fa94c773ba
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
PO11557.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\2b9f14c7f031fd1035abf9fa94c773ba = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO11557.exe\" .." PO11557.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2b9f14c7f031fd1035abf9fa94c773ba = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO11557.exe\" .." PO11557.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO11557.exedescription pid process target process PID 1932 set thread context of 1768 1932 PO11557.exe PO11557.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
PO11557.exepowershell.exepid process 1932 PO11557.exe 1932 PO11557.exe 1932 PO11557.exe 1932 PO11557.exe 1932 PO11557.exe 1932 PO11557.exe 1932 PO11557.exe 1744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
PO11557.exepowershell.exePO11557.exedescription pid process Token: SeDebugPrivilege 1932 PO11557.exe Token: SeDebugPrivilege 1744 powershell.exe Token: SeDebugPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe Token: 33 1768 PO11557.exe Token: SeIncBasePriorityPrivilege 1768 PO11557.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
PO11557.exePO11557.exedescription pid process target process PID 1932 wrote to memory of 1744 1932 PO11557.exe powershell.exe PID 1932 wrote to memory of 1744 1932 PO11557.exe powershell.exe PID 1932 wrote to memory of 1744 1932 PO11557.exe powershell.exe PID 1932 wrote to memory of 1744 1932 PO11557.exe powershell.exe PID 1932 wrote to memory of 2000 1932 PO11557.exe schtasks.exe PID 1932 wrote to memory of 2000 1932 PO11557.exe schtasks.exe PID 1932 wrote to memory of 2000 1932 PO11557.exe schtasks.exe PID 1932 wrote to memory of 2000 1932 PO11557.exe schtasks.exe PID 1932 wrote to memory of 1572 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1572 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1572 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1572 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1500 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1500 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1500 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1500 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1768 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1768 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1768 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1768 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1768 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1768 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1768 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1768 1932 PO11557.exe PO11557.exe PID 1932 wrote to memory of 1768 1932 PO11557.exe PO11557.exe PID 1768 wrote to memory of 932 1768 PO11557.exe netsh.exe PID 1768 wrote to memory of 932 1768 PO11557.exe netsh.exe PID 1768 wrote to memory of 932 1768 PO11557.exe netsh.exe PID 1768 wrote to memory of 932 1768 PO11557.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO11557.exe"C:\Users\Admin\AppData\Local\Temp\PO11557.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VnuJgEcRT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VnuJgEcRT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC330.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO11557.exe"C:\Users\Admin\AppData\Local\Temp\PO11557.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO11557.exe"C:\Users\Admin\AppData\Local\Temp\PO11557.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO11557.exe"C:\Users\Admin\AppData\Local\Temp\PO11557.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\PO11557.exe" "PO11557.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC330.tmpMD5
792e9233a4e9869059d384d1b2cd9f0b
SHA19caf686bed16fb971bec771340db3c3bab7d2f2d
SHA25692856226c9993c3cca7a3c539ef8fcbe6aa3db5030e871dc0d6824cb1c4fe4c4
SHA512b70cf0aa02b175a7003704eea83345c2f44894756fb2f9598b9e0d313dc016ec60da396a536f671fd2e244519f36818bf6dfce464a0d735eeac06b5a99928efc
-
memory/932-77-0x0000000000000000-mapping.dmp
-
memory/1744-62-0x0000000000000000-mapping.dmp
-
memory/1744-76-0x0000000001CD2000-0x0000000001CD4000-memory.dmpFilesize
8KB
-
memory/1744-75-0x0000000001CD1000-0x0000000001CD2000-memory.dmpFilesize
4KB
-
memory/1744-74-0x0000000001CD0000-0x0000000001CD1000-memory.dmpFilesize
4KB
-
memory/1768-72-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1768-70-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1768-80-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/1768-66-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1768-67-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1768-68-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1768-69-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1768-79-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/1768-71-0x000000000040747E-mapping.dmp
-
memory/1932-55-0x0000000001340000-0x0000000001341000-memory.dmpFilesize
4KB
-
memory/1932-60-0x0000000000A40000-0x0000000000A6A000-memory.dmpFilesize
168KB
-
memory/1932-59-0x0000000000600000-0x0000000000607000-memory.dmpFilesize
28KB
-
memory/1932-58-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1932-57-0x0000000075901000-0x0000000075903000-memory.dmpFilesize
8KB
-
memory/1932-61-0x0000000000A70000-0x0000000000A79000-memory.dmpFilesize
36KB
-
memory/2000-63-0x0000000000000000-mapping.dmp