Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
17-11-2021 05:36
Static task
static1
Behavioral task
behavioral1
Sample
PO11557.exe
Resource
win7-en-20211014
General
-
Target
PO11557.exe
-
Size
662KB
-
MD5
51b5e9e7d1d63c1acd6df20dda31004a
-
SHA1
2a935b93c9135bb4d0d849c8219c453075bcdf47
-
SHA256
2c6fae2182c59ef4cee6b63e29cf7fa66990e40ad5c22b6a469d3c935766202c
-
SHA512
f91f54e994b898e96743ece7f61613301d78e398361d10bbd25c0b59e59bd75fe6a438adc8ce4ce20031fa2202d4c7a5239bbbf105aba8619b43717950b6a202
Malware Config
Extracted
njrat
0.7d
HacKed
107.155.132.152:5552
2b9f14c7f031fd1035abf9fa94c773ba
-
reg_key
2b9f14c7f031fd1035abf9fa94c773ba
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
PO11557.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2b9f14c7f031fd1035abf9fa94c773ba = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO11557.exe\" .." PO11557.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\2b9f14c7f031fd1035abf9fa94c773ba = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO11557.exe\" .." PO11557.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO11557.exedescription pid process target process PID 2412 set thread context of 800 2412 PO11557.exe PO11557.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
PO11557.exepowershell.exepid process 2412 PO11557.exe 2412 PO11557.exe 2412 PO11557.exe 2276 powershell.exe 2276 powershell.exe 2276 powershell.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
PO11557.exepowershell.exePO11557.exedescription pid process Token: SeDebugPrivilege 2412 PO11557.exe Token: SeDebugPrivilege 2276 powershell.exe Token: SeDebugPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe Token: 33 800 PO11557.exe Token: SeIncBasePriorityPrivilege 800 PO11557.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PO11557.exePO11557.exedescription pid process target process PID 2412 wrote to memory of 2276 2412 PO11557.exe powershell.exe PID 2412 wrote to memory of 2276 2412 PO11557.exe powershell.exe PID 2412 wrote to memory of 2276 2412 PO11557.exe powershell.exe PID 2412 wrote to memory of 3984 2412 PO11557.exe schtasks.exe PID 2412 wrote to memory of 3984 2412 PO11557.exe schtasks.exe PID 2412 wrote to memory of 3984 2412 PO11557.exe schtasks.exe PID 2412 wrote to memory of 800 2412 PO11557.exe PO11557.exe PID 2412 wrote to memory of 800 2412 PO11557.exe PO11557.exe PID 2412 wrote to memory of 800 2412 PO11557.exe PO11557.exe PID 2412 wrote to memory of 800 2412 PO11557.exe PO11557.exe PID 2412 wrote to memory of 800 2412 PO11557.exe PO11557.exe PID 2412 wrote to memory of 800 2412 PO11557.exe PO11557.exe PID 2412 wrote to memory of 800 2412 PO11557.exe PO11557.exe PID 2412 wrote to memory of 800 2412 PO11557.exe PO11557.exe PID 800 wrote to memory of 2364 800 PO11557.exe netsh.exe PID 800 wrote to memory of 2364 800 PO11557.exe netsh.exe PID 800 wrote to memory of 2364 800 PO11557.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO11557.exe"C:\Users\Admin\AppData\Local\Temp\PO11557.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VnuJgEcRT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VnuJgEcRT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp88C4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO11557.exe"C:\Users\Admin\AppData\Local\Temp\PO11557.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\PO11557.exe" "PO11557.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp88C4.tmpMD5
7304afd3fdfa6bcb303dfc2029d7264e
SHA1059bc6722a458ea4bd4f12924936532517851780
SHA2561f745966a4877e996ad3ae58c5b9ef2888e1759ca773b5bd4066d7fdf0f8c5e0
SHA51278a88ed4e35694561060f9791937216730d74f398cd63473568a7f1b0e765f94907c02b1287355b0a158a33a4cfb82ed25fe37d3c07870ee1c612a732b92e17f
-
memory/800-312-0x0000000004E40000-0x000000000533E000-memory.dmpFilesize
5.0MB
-
memory/800-136-0x000000000040747E-mapping.dmp
-
memory/800-135-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2276-141-0x0000000006840000-0x0000000006841000-memory.dmpFilesize
4KB
-
memory/2276-142-0x0000000006842000-0x0000000006843000-memory.dmpFilesize
4KB
-
memory/2276-182-0x0000000006843000-0x0000000006844000-memory.dmpFilesize
4KB
-
memory/2276-171-0x0000000008F50000-0x0000000008F51000-memory.dmpFilesize
4KB
-
memory/2276-170-0x000000007F880000-0x000000007F881000-memory.dmpFilesize
4KB
-
memory/2276-128-0x0000000000000000-mapping.dmp
-
memory/2276-169-0x0000000008D90000-0x0000000008D91000-memory.dmpFilesize
4KB
-
memory/2276-130-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/2276-131-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/2276-132-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/2276-164-0x00000000089C0000-0x00000000089C1000-memory.dmpFilesize
4KB
-
memory/2276-134-0x0000000006E80000-0x0000000006E81000-memory.dmpFilesize
4KB
-
memory/2276-157-0x00000000089E0000-0x0000000008A13000-memory.dmpFilesize
204KB
-
memory/2276-150-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/2276-149-0x0000000007BA0000-0x0000000007BA1000-memory.dmpFilesize
4KB
-
memory/2276-148-0x0000000007CE0000-0x0000000007CE1000-memory.dmpFilesize
4KB
-
memory/2276-143-0x0000000006D80000-0x0000000006D81000-memory.dmpFilesize
4KB
-
memory/2276-144-0x0000000006BC0000-0x0000000006BC1000-memory.dmpFilesize
4KB
-
memory/2276-145-0x00000000074B0000-0x00000000074B1000-memory.dmpFilesize
4KB
-
memory/2276-146-0x0000000007520000-0x0000000007521000-memory.dmpFilesize
4KB
-
memory/2276-147-0x0000000006E30000-0x0000000006E31000-memory.dmpFilesize
4KB
-
memory/2364-193-0x0000000000000000-mapping.dmp
-
memory/2412-124-0x00000000054E0000-0x00000000054E7000-memory.dmpFilesize
28KB
-
memory/2412-118-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/2412-121-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/2412-122-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/2412-123-0x0000000005260000-0x000000000575E000-memory.dmpFilesize
5.0MB
-
memory/2412-127-0x00000000079A0000-0x00000000079A9000-memory.dmpFilesize
36KB
-
memory/2412-126-0x0000000007970000-0x000000000799A000-memory.dmpFilesize
168KB
-
memory/2412-125-0x00000000079E0000-0x00000000079E1000-memory.dmpFilesize
4KB
-
memory/2412-120-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/3984-129-0x0000000000000000-mapping.dmp