Analysis
-
max time kernel
192s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-05-2022 15:05
Static task
static1
Behavioral task
behavioral1
Sample
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe
Resource
win10v2004-20220414-en
General
-
Target
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe
-
Size
123KB
-
MD5
946333d7d6a396ab789cb72f74c7f9aa
-
SHA1
07391a865a6c0d781fae9754872d05437bd2ced5
-
SHA256
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
-
SHA512
382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
Malware Config
Extracted
njrat
Hacked By HiDDen PerSOn
e6be5f00f026aa28102ba2f0df8f3ec3
-
reg_key
e6be5f00f026aa28102ba2f0df8f3ec3
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
System32.exeSystem32.exepid process 3780 System32.exe 4392 System32.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe -
Drops startup file 2 IoCs
Processes:
System32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6be5f00f026aa28102ba2f0df8f3ec3.exe System32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6be5f00f026aa28102ba2f0df8f3ec3.exe System32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
System32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e6be5f00f026aa28102ba2f0df8f3ec3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e6be5f00f026aa28102ba2f0df8f3ec3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exeSystem32.exedescription pid process target process PID 4476 set thread context of 4668 4476 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 3780 set thread context of 4392 3780 System32.exe System32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
System32.exedescription pid process Token: SeDebugPrivilege 4392 System32.exe Token: 33 4392 System32.exe Token: SeIncBasePriorityPrivilege 4392 System32.exe Token: 33 4392 System32.exe Token: SeIncBasePriorityPrivilege 4392 System32.exe Token: 33 4392 System32.exe Token: SeIncBasePriorityPrivilege 4392 System32.exe Token: 33 4392 System32.exe Token: SeIncBasePriorityPrivilege 4392 System32.exe Token: 33 4392 System32.exe Token: SeIncBasePriorityPrivilege 4392 System32.exe Token: 33 4392 System32.exe Token: SeIncBasePriorityPrivilege 4392 System32.exe Token: 33 4392 System32.exe Token: SeIncBasePriorityPrivilege 4392 System32.exe Token: 33 4392 System32.exe Token: SeIncBasePriorityPrivilege 4392 System32.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exeSystem32.exeSystem32.exedescription pid process target process PID 4476 wrote to memory of 4668 4476 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 4476 wrote to memory of 4668 4476 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 4476 wrote to memory of 4668 4476 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 4476 wrote to memory of 4668 4476 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 4476 wrote to memory of 4668 4476 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 4476 wrote to memory of 4668 4476 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 4476 wrote to memory of 4668 4476 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 4476 wrote to memory of 4668 4476 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe PID 4668 wrote to memory of 3780 4668 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe System32.exe PID 4668 wrote to memory of 3780 4668 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe System32.exe PID 4668 wrote to memory of 3780 4668 08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe System32.exe PID 3780 wrote to memory of 4392 3780 System32.exe System32.exe PID 3780 wrote to memory of 4392 3780 System32.exe System32.exe PID 3780 wrote to memory of 4392 3780 System32.exe System32.exe PID 3780 wrote to memory of 4392 3780 System32.exe System32.exe PID 3780 wrote to memory of 4392 3780 System32.exe System32.exe PID 3780 wrote to memory of 4392 3780 System32.exe System32.exe PID 3780 wrote to memory of 4392 3780 System32.exe System32.exe PID 3780 wrote to memory of 4392 3780 System32.exe System32.exe PID 4392 wrote to memory of 3812 4392 System32.exe netsh.exe PID 4392 wrote to memory of 3812 4392 System32.exe netsh.exe PID 4392 wrote to memory of 3812 4392 System32.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe"C:\Users\Admin\AppData\Local\Temp\08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe"C:\Users\Admin\AppData\Local\Temp\08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System32.exe" "System32.exe" ENABLE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\08a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180.exe.logFilesize
617B
MD5f5a69d9216974a1b017e4e94be20c63f
SHA16993175a82e6ffa484b2bfbf691668f11484ef17
SHA256471ce598bfe72b7166f3e1b669c84436e2d6cb758dd98e8d0e4cb44a230f42ee
SHA512d9164f8573c6cabd01357e8f27e1500100ae932aed51f6a08734dc739e36c61e2e8b231f6ce3aaac2d9b279c3ade0ad7c5189925ee7d75d4820acfdd2cac11fd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System32.exe.logFilesize
617B
MD5f5a69d9216974a1b017e4e94be20c63f
SHA16993175a82e6ffa484b2bfbf691668f11484ef17
SHA256471ce598bfe72b7166f3e1b669c84436e2d6cb758dd98e8d0e4cb44a230f42ee
SHA512d9164f8573c6cabd01357e8f27e1500100ae932aed51f6a08734dc739e36c61e2e8b231f6ce3aaac2d9b279c3ade0ad7c5189925ee7d75d4820acfdd2cac11fd
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
123KB
MD5946333d7d6a396ab789cb72f74c7f9aa
SHA107391a865a6c0d781fae9754872d05437bd2ced5
SHA25608a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
SHA512382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
123KB
MD5946333d7d6a396ab789cb72f74c7f9aa
SHA107391a865a6c0d781fae9754872d05437bd2ced5
SHA25608a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
SHA512382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
-
C:\Users\Admin\AppData\Local\Temp\System32.exeFilesize
123KB
MD5946333d7d6a396ab789cb72f74c7f9aa
SHA107391a865a6c0d781fae9754872d05437bd2ced5
SHA25608a16325eb4523ff4193355516d182c1e8fcb3016409c92193f51053dd4fe180
SHA512382cca85edecb737762c14eee850fc887745be8d1e33cf4f9521db42dcaed95d23c342532e015c6a7e792f2fde72161e064405147b3060850aa6d9139ed858df
-
memory/3780-138-0x0000000000000000-mapping.dmp
-
memory/3812-145-0x0000000000000000-mapping.dmp
-
memory/4392-141-0x0000000000000000-mapping.dmp
-
memory/4392-146-0x0000000005A90000-0x0000000005B22000-memory.dmpFilesize
584KB
-
memory/4392-147-0x0000000005990000-0x000000000599A000-memory.dmpFilesize
40KB
-
memory/4476-132-0x0000000000200000-0x0000000000226000-memory.dmpFilesize
152KB
-
memory/4476-134-0x0000000004EA0000-0x0000000004F3C000-memory.dmpFilesize
624KB
-
memory/4476-133-0x0000000005370000-0x0000000005914000-memory.dmpFilesize
5.6MB
-
memory/4668-136-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/4668-135-0x0000000000000000-mapping.dmp