Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
09/03/2022, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
27de9fa03f4c3950e07c978ae4251c75.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
General
- Target 27de9fa03f4c3950e07c978ae4251c75.exe
- Size 26KB
- Sample220309-tt9n2aaed7
- SHA256 07c7268c2f8a736f5c74f9dabfdf5e10c8a4580fdfcf11eaa7e20a88dd52cae8
- MD5 27de9fa03f4c3950e07c978ae4251c75
- SHA1 d194c4d64582b2d4b86b099429c3c31172744ec4
- SHA512 4ace43cc60534685f8f22816f0c24d2a32b1cc30fd718fb09ea049aaecec3d4624d6fdaa669dce121ebb1558715911b00ac9ec836d96f708c16117c7f8924039
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
njrat
Version
-
0.7NC
Botnet
-
NYAN CAT
C2
-
diosamor27.duckdns.org:8899
Mutex
-
e7466a02bcd
Attributes
-
reg_key
e7466a02bcd
-
splitter
@!#&^%$
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\27de9fa03f4c3950e07c978ae4251c75.exe 27de9fa03f4c3950e07c978ae4251c75.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\27de9fa03f4c3950e07c978ae4251c75.exe 27de9fa03f4c3950e07c978ae4251c75.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3516 set thread context of 3916 3516 27de9fa03f4c3950e07c978ae4251c75.exe 63 - Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe 3516 27de9fa03f4c3950e07c978ae4251c75.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 3516 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeDebugPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: 33 3916 27de9fa03f4c3950e07c978ae4251c75.exe Token: SeIncBasePriorityPrivilege 3916 27de9fa03f4c3950e07c978ae4251c75.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3516 wrote to memory of 3916 3516 27de9fa03f4c3950e07c978ae4251c75.exe 63 PID 3516 wrote to memory of 3916 3516 27de9fa03f4c3950e07c978ae4251c75.exe 63 PID 3516 wrote to memory of 3916 3516 27de9fa03f4c3950e07c978ae4251c75.exe 63 PID 3516 wrote to memory of 3916 3516 27de9fa03f4c3950e07c978ae4251c75.exe 63 PID 3516 wrote to memory of 3916 3516 27de9fa03f4c3950e07c978ae4251c75.exe 63 PID 3516 wrote to memory of 3916 3516 27de9fa03f4c3950e07c978ae4251c75.exe 63 PID 3516 wrote to memory of 3916 3516 27de9fa03f4c3950e07c978ae4251c75.exe 63 PID 3516 wrote to memory of 3916 3516 27de9fa03f4c3950e07c978ae4251c75.exe 63
Processes
-
C:\Users\Admin\AppData\Local\Temp\27de9fa03f4c3950e07c978ae4251c75.exe"C:\Users\Admin\AppData\Local\Temp\27de9fa03f4c3950e07c978ae4251c75.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\27de9fa03f4c3950e07c978ae4251c75.exe"C:\Users\Admin\AppData\Local\Temp\27de9fa03f4c3950e07c978ae4251c75.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916
-