Analysis
-
max time kernel
172s -
max time network
191s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 22:54
Static task
static1
Behavioral task
behavioral1
Sample
1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe
Resource
win10-en-20211208
General
-
Target
1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe
-
Size
1.0MB
-
MD5
08d5c4483e2106305bc73d6456455f2e
-
SHA1
ee5c737012942806df0a834ebd3914bd8bb19702
-
SHA256
1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed
-
SHA512
1c4dbc3273b617704d78e35c5903c6872bb904249f84ae2de5facd9cf2f365d3a9de9e4eccca6a624e9b922dcf856c052e299485d34df22a097dbbfc4ac6952a
Malware Config
Extracted
njrat
0.7.3
ZZZZZZQUARENTINEE
tonystark2025.duckdns.org:4010
Client.exe
-
reg_key
Client.exe
-
splitter
1234
Signatures
-
Drops startup file 1 IoCs
Processes:
1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AssignedAccessManager.url 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exedescription pid process target process PID 2792 set thread context of 4036 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe Token: 33 4036 MSBuild.exe Token: SeIncBasePriorityPrivilege 4036 MSBuild.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exepid process 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exepid process 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exedescription pid process target process PID 2792 wrote to memory of 4036 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe MSBuild.exe PID 2792 wrote to memory of 4036 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe MSBuild.exe PID 2792 wrote to memory of 4036 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe MSBuild.exe PID 2792 wrote to memory of 4036 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe MSBuild.exe PID 2792 wrote to memory of 4036 2792 1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe"C:\Users\Admin\AppData\Local\Temp\1960fc0413732cabf1620cd1244d354238bda3d31210feff72570dc825e3c4ed.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2792-115-0x0000000001160000-0x0000000001188000-memory.dmpFilesize
160KB
-
memory/2792-116-0x0000000001190000-0x00000000011B8000-memory.dmpFilesize
160KB
-
memory/4036-117-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4036-122-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB