Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07-01-2022 01:12
Behavioral task
behavioral1
Sample
b93287f2b98af1aefebef7a4b46a689c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b93287f2b98af1aefebef7a4b46a689c.exe
Resource
win10-en-20211208
General
-
Target
b93287f2b98af1aefebef7a4b46a689c.exe
-
Size
43KB
-
MD5
b93287f2b98af1aefebef7a4b46a689c
-
SHA1
1329369d122864910f735aa6b1740e85516806c1
-
SHA256
bfa74e548efbc9dda9420f88bb84f6f23c034399a16df9093b6a27e33621e44b
-
SHA512
7fe3185f2c9f0b37f69f780fecb0ff8240116267249212b39371d4966453c6cd018f43b8690c06e5f3beb79a1a2103625e6bd408b284a066eef36c4d5111f067
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
6.tcp.ngrok.io:15544
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
dllhost.exeServer.exeServer.exepid process 672 dllhost.exe 1116 Server.exe 368 Server.exe -
Drops startup file 2 IoCs
Processes:
dllhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.exe dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.exe dllhost.exe -
Loads dropped DLL 1 IoCs
Processes:
b93287f2b98af1aefebef7a4b46a689c.exepid process 1460 b93287f2b98af1aefebef7a4b46a689c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
b93287f2b98af1aefebef7a4b46a689c.exedllhost.exepid process 1460 b93287f2b98af1aefebef7a4b46a689c.exe 672 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
dllhost.exedescription pid process Token: SeDebugPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe Token: 33 672 dllhost.exe Token: SeIncBasePriorityPrivilege 672 dllhost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
b93287f2b98af1aefebef7a4b46a689c.exedllhost.exetaskeng.exedescription pid process target process PID 1460 wrote to memory of 672 1460 b93287f2b98af1aefebef7a4b46a689c.exe dllhost.exe PID 1460 wrote to memory of 672 1460 b93287f2b98af1aefebef7a4b46a689c.exe dllhost.exe PID 1460 wrote to memory of 672 1460 b93287f2b98af1aefebef7a4b46a689c.exe dllhost.exe PID 1460 wrote to memory of 672 1460 b93287f2b98af1aefebef7a4b46a689c.exe dllhost.exe PID 672 wrote to memory of 836 672 dllhost.exe schtasks.exe PID 672 wrote to memory of 836 672 dllhost.exe schtasks.exe PID 672 wrote to memory of 836 672 dllhost.exe schtasks.exe PID 672 wrote to memory of 836 672 dllhost.exe schtasks.exe PID 1836 wrote to memory of 1116 1836 taskeng.exe Server.exe PID 1836 wrote to memory of 1116 1836 taskeng.exe Server.exe PID 1836 wrote to memory of 1116 1836 taskeng.exe Server.exe PID 1836 wrote to memory of 1116 1836 taskeng.exe Server.exe PID 1836 wrote to memory of 368 1836 taskeng.exe Server.exe PID 1836 wrote to memory of 368 1836 taskeng.exe Server.exe PID 1836 wrote to memory of 368 1836 taskeng.exe Server.exe PID 1836 wrote to memory of 368 1836 taskeng.exe Server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b93287f2b98af1aefebef7a4b46a689c.exe"C:\Users\Admin\AppData\Local\Temp\b93287f2b98af1aefebef7a4b46a689c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {EBD0E030-DFDB-4F03-887C-5311A544412F} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Server.exeMD5
b93287f2b98af1aefebef7a4b46a689c
SHA11329369d122864910f735aa6b1740e85516806c1
SHA256bfa74e548efbc9dda9420f88bb84f6f23c034399a16df9093b6a27e33621e44b
SHA5127fe3185f2c9f0b37f69f780fecb0ff8240116267249212b39371d4966453c6cd018f43b8690c06e5f3beb79a1a2103625e6bd408b284a066eef36c4d5111f067
-
C:\Users\Admin\AppData\Local\Temp\Server.exeMD5
b93287f2b98af1aefebef7a4b46a689c
SHA11329369d122864910f735aa6b1740e85516806c1
SHA256bfa74e548efbc9dda9420f88bb84f6f23c034399a16df9093b6a27e33621e44b
SHA5127fe3185f2c9f0b37f69f780fecb0ff8240116267249212b39371d4966453c6cd018f43b8690c06e5f3beb79a1a2103625e6bd408b284a066eef36c4d5111f067
-
C:\Users\Admin\AppData\Local\Temp\Server.exeMD5
b93287f2b98af1aefebef7a4b46a689c
SHA11329369d122864910f735aa6b1740e85516806c1
SHA256bfa74e548efbc9dda9420f88bb84f6f23c034399a16df9093b6a27e33621e44b
SHA5127fe3185f2c9f0b37f69f780fecb0ff8240116267249212b39371d4966453c6cd018f43b8690c06e5f3beb79a1a2103625e6bd408b284a066eef36c4d5111f067
-
C:\Users\Admin\AppData\Local\Temp\dllhost.exeMD5
b93287f2b98af1aefebef7a4b46a689c
SHA11329369d122864910f735aa6b1740e85516806c1
SHA256bfa74e548efbc9dda9420f88bb84f6f23c034399a16df9093b6a27e33621e44b
SHA5127fe3185f2c9f0b37f69f780fecb0ff8240116267249212b39371d4966453c6cd018f43b8690c06e5f3beb79a1a2103625e6bd408b284a066eef36c4d5111f067
-
C:\Users\Admin\AppData\Local\Temp\dllhost.exeMD5
b93287f2b98af1aefebef7a4b46a689c
SHA11329369d122864910f735aa6b1740e85516806c1
SHA256bfa74e548efbc9dda9420f88bb84f6f23c034399a16df9093b6a27e33621e44b
SHA5127fe3185f2c9f0b37f69f780fecb0ff8240116267249212b39371d4966453c6cd018f43b8690c06e5f3beb79a1a2103625e6bd408b284a066eef36c4d5111f067
-
\Users\Admin\AppData\Local\Temp\dllhost.exeMD5
b93287f2b98af1aefebef7a4b46a689c
SHA11329369d122864910f735aa6b1740e85516806c1
SHA256bfa74e548efbc9dda9420f88bb84f6f23c034399a16df9093b6a27e33621e44b
SHA5127fe3185f2c9f0b37f69f780fecb0ff8240116267249212b39371d4966453c6cd018f43b8690c06e5f3beb79a1a2103625e6bd408b284a066eef36c4d5111f067
-
memory/368-71-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/368-68-0x0000000000000000-mapping.dmp
-
memory/672-61-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/672-57-0x0000000000000000-mapping.dmp
-
memory/836-62-0x0000000000000000-mapping.dmp
-
memory/1116-64-0x0000000000000000-mapping.dmp
-
memory/1116-67-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/1460-54-0x0000000000450000-0x0000000000451000-memory.dmpFilesize
4KB
-
memory/1460-55-0x00000000751B1000-0x00000000751B3000-memory.dmpFilesize
8KB