Analysis
-
max time kernel
152s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-05-2022 15:05
Static task
static1
Behavioral task
behavioral1
Sample
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe
Resource
win10v2004-20220414-en
General
-
Target
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe
-
Size
123KB
-
MD5
946333d7d6a396ab789cb72f74c7f9aa
-
SHA1
07391a865a6c0d781fae9754872d05437bd2ced5
-
SHA256
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
-
SHA512
382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
Malware Config
Extracted
njrat
Hacked By HiDDen PerSOn
e6be5f00f026aa28102ba2f0df8f3ec3
-
reg_key
e6be5f00f026aa28102ba2f0df8f3ec3
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
System32.exeSystem32.exepid process 1312 System32.exe 1456 System32.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
System32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6be5f00f026aa28102ba2f0df8f3ec3.exe System32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6be5f00f026aa28102ba2f0df8f3ec3.exe System32.exe -
Loads dropped DLL 2 IoCs
Processes:
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exeSystem32.exepid process 628 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 1312 System32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
System32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\e6be5f00f026aa28102ba2f0df8f3ec3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\e6be5f00f026aa28102ba2f0df8f3ec3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exeSystem32.exedescription pid process target process PID 1696 set thread context of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 1312 set thread context of 1456 1312 System32.exe System32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
System32.exedescription pid process Token: SeDebugPrivilege 1456 System32.exe Token: 33 1456 System32.exe Token: SeIncBasePriorityPrivilege 1456 System32.exe Token: 33 1456 System32.exe Token: SeIncBasePriorityPrivilege 1456 System32.exe Token: 33 1456 System32.exe Token: SeIncBasePriorityPrivilege 1456 System32.exe Token: 33 1456 System32.exe Token: SeIncBasePriorityPrivilege 1456 System32.exe Token: 33 1456 System32.exe Token: SeIncBasePriorityPrivilege 1456 System32.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exeSystem32.exeSystem32.exedescription pid process target process PID 1696 wrote to memory of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 1696 wrote to memory of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 1696 wrote to memory of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 1696 wrote to memory of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 1696 wrote to memory of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 1696 wrote to memory of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 1696 wrote to memory of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 1696 wrote to memory of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 1696 wrote to memory of 628 1696 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 628 wrote to memory of 1312 628 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe System32.exe PID 628 wrote to memory of 1312 628 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe System32.exe PID 628 wrote to memory of 1312 628 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe System32.exe PID 628 wrote to memory of 1312 628 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe System32.exe PID 1312 wrote to memory of 1456 1312 System32.exe System32.exe PID 1312 wrote to memory of 1456 1312 System32.exe System32.exe PID 1312 wrote to memory of 1456 1312 System32.exe System32.exe PID 1312 wrote to memory of 1456 1312 System32.exe System32.exe PID 1312 wrote to memory of 1456 1312 System32.exe System32.exe PID 1312 wrote to memory of 1456 1312 System32.exe System32.exe PID 1312 wrote to memory of 1456 1312 System32.exe System32.exe PID 1312 wrote to memory of 1456 1312 System32.exe System32.exe PID 1312 wrote to memory of 1456 1312 System32.exe System32.exe PID 1456 wrote to memory of 1152 1456 System32.exe netsh.exe PID 1456 wrote to memory of 1152 1456 System32.exe netsh.exe PID 1456 wrote to memory of 1152 1456 System32.exe netsh.exe PID 1456 wrote to memory of 1152 1456 System32.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe"C:\Users\Admin\AppData\Local\Temp\08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe"C:\Users\Admin\AppData\Local\Temp\08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System32.exe" "System32.exe" ENABLE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
123KB
MD5946333d7d6a396ab789cb72f74c7f9aa
SHA107391a865a6c0d781fae9754872d05437bd2ced5
SHA25608a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
SHA512382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
123KB
MD5946333d7d6a396ab789cb72f74c7f9aa
SHA107391a865a6c0d781fae9754872d05437bd2ced5
SHA25608a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
SHA512382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
123KB
MD5946333d7d6a396ab789cb72f74c7f9aa
SHA107391a865a6c0d781fae9754872d05437bd2ced5
SHA25608a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
SHA512382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
-
\Users\Admin\AppData\Local\Temp\System32.exeFilesize
123KB
MD5946333d7d6a396ab789cb72f74c7f9aa
SHA107391a865a6c0d781fae9754872d05437bd2ced5
SHA25608a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
SHA512382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
-
\Users\Admin\AppData\Local\Temp\System32.exeFilesize
123KB
MD5946333d7d6a396ab789cb72f74c7f9aa
SHA107391a865a6c0d781fae9754872d05437bd2ced5
SHA25608a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
SHA512382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
-
memory/628-67-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/628-57-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/628-62-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/628-63-0x00000000004097EE-mapping.dmp
-
memory/628-65-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/628-58-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/628-61-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/628-60-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1152-88-0x0000000000000000-mapping.dmp
-
memory/1312-70-0x0000000000000000-mapping.dmp
-
memory/1312-73-0x0000000000840000-0x0000000000866000-memory.dmpFilesize
152KB
-
memory/1456-82-0x00000000004097EE-mapping.dmp
-
memory/1696-56-0x00000000005D0000-0x00000000005E4000-memory.dmpFilesize
80KB
-
memory/1696-55-0x0000000075371000-0x0000000075373000-memory.dmpFilesize
8KB
-
memory/1696-54-0x0000000001020000-0x0000000001046000-memory.dmpFilesize
152KB