Analysis
-
max time kernel
151s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 23:50
Static task
static1
Behavioral task
behavioral1
Sample
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe
Resource
win10-en-20211208
General
-
Target
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe
-
Size
264KB
-
MD5
695c5d19dc3c3c5cc39182e09d9274e6
-
SHA1
bc0aa3fce44b7d252919d820860709a0052cb76c
-
SHA256
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436
-
SHA512
a20bf0b073c43f55f9a8797e093422b2aea58949fa23e625e20ce9786421c120253cd4f988aa3b2f877d9cc7f6c472e8daabe58489d7b7ea2bec5c339e855e4b
Malware Config
Extracted
njrat
0.7d
zalupa180417
808080.ddns.net:5555
4cb72bb7475074f5af41f3e5e189ee3f
-
reg_key
4cb72bb7475074f5af41f3e5e189ee3f
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FlashUpdate.exe 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FlashUpdate.exe 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exedescription pid process target process PID 1680 set thread context of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exepid process 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe Token: SeDebugPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe Token: 33 792 RegAsm.exe Token: SeIncBasePriorityPrivilege 792 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exeRegAsm.exedescription pid process target process PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 1680 wrote to memory of 792 1680 6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe RegAsm.exe PID 792 wrote to memory of 1180 792 RegAsm.exe netsh.exe PID 792 wrote to memory of 1180 792 RegAsm.exe netsh.exe PID 792 wrote to memory of 1180 792 RegAsm.exe netsh.exe PID 792 wrote to memory of 1180 792 RegAsm.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe"C:\Users\Admin\AppData\Local\Temp\6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/792-57-0x0000000000090000-0x000000000009C000-memory.dmpFilesize
48KB
-
memory/792-58-0x0000000000090000-0x000000000009C000-memory.dmpFilesize
48KB
-
memory/792-59-0x0000000000090000-0x000000000009C000-memory.dmpFilesize
48KB
-
memory/792-60-0x0000000000090000-0x000000000009C000-memory.dmpFilesize
48KB
-
memory/792-62-0x0000000000090000-0x000000000009C000-memory.dmpFilesize
48KB
-
memory/792-68-0x0000000000090000-0x000000000009C000-memory.dmpFilesize
48KB
-
memory/792-65-0x0000000000090000-0x000000000009C000-memory.dmpFilesize
48KB
-
memory/792-70-0x00000000007A0000-0x00000000007A1000-memory.dmpFilesize
4KB
-
memory/1680-54-0x0000000075891000-0x0000000075893000-memory.dmpFilesize
8KB
-
memory/1680-55-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1680-56-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB