Analysis
-
max time kernel
151s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:11
Behavioral task
behavioral1
Sample
1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe
Resource
win10v2004-20220414-en
General
-
Target
1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe
-
Size
43KB
-
MD5
641bf525a313f41f133cd1db2d07da2b
-
SHA1
2da56f55034be144ba85cc9c83af4f09aa591c9e
-
SHA256
1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
-
SHA512
4921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
pashat.exeServer.exeServer.exepid process 1980 pashat.exe 688 Server.exe 3980 Server.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe -
Drops startup file 2 IoCs
Processes:
pashat.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe pashat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe pashat.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
pashat.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pashat.exe\" .." pashat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pashat.exe\" .." pashat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exepashat.exepid process 1544 1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe 1980 pashat.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
pashat.exedescription pid process Token: SeDebugPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe Token: 33 1980 pashat.exe Token: SeIncBasePriorityPrivilege 1980 pashat.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exepashat.exedescription pid process target process PID 1544 wrote to memory of 1980 1544 1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe pashat.exe PID 1544 wrote to memory of 1980 1544 1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe pashat.exe PID 1544 wrote to memory of 1980 1544 1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe pashat.exe PID 1980 wrote to memory of 3884 1980 pashat.exe schtasks.exe PID 1980 wrote to memory of 3884 1980 pashat.exe schtasks.exe PID 1980 wrote to memory of 3884 1980 pashat.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe"C:\Users\Admin\AppData\Local\Temp\1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pashat.exe"C:\Users\Admin\AppData\Local\Temp\pashat.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.logFilesize
507B
MD525d1b50e7c0d451f3d850eb54d27ca05
SHA1a238807715c70a335f54e80d4855644b21a9e870
SHA256650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5
SHA5124223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD5641bf525a313f41f133cd1db2d07da2b
SHA12da56f55034be144ba85cc9c83af4f09aa591c9e
SHA2561f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
SHA5124921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD5641bf525a313f41f133cd1db2d07da2b
SHA12da56f55034be144ba85cc9c83af4f09aa591c9e
SHA2561f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
SHA5124921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD5641bf525a313f41f133cd1db2d07da2b
SHA12da56f55034be144ba85cc9c83af4f09aa591c9e
SHA2561f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
SHA5124921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
-
C:\Users\Admin\AppData\Local\Temp\pashat.exeFilesize
43KB
MD5641bf525a313f41f133cd1db2d07da2b
SHA12da56f55034be144ba85cc9c83af4f09aa591c9e
SHA2561f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
SHA5124921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
-
C:\Users\Admin\AppData\Local\Temp\pashat.exeFilesize
43KB
MD5641bf525a313f41f133cd1db2d07da2b
SHA12da56f55034be144ba85cc9c83af4f09aa591c9e
SHA2561f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
SHA5124921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
-
memory/1544-133-0x0000000000680000-0x0000000000692000-memory.dmpFilesize
72KB
-
memory/1544-136-0x0000000005460000-0x00000000054F2000-memory.dmpFilesize
584KB
-
memory/1544-135-0x0000000005970000-0x0000000005F14000-memory.dmpFilesize
5.6MB
-
memory/1544-134-0x0000000005050000-0x00000000050EC000-memory.dmpFilesize
624KB
-
memory/1980-141-0x0000000005B20000-0x0000000005B2A000-memory.dmpFilesize
40KB
-
memory/1980-137-0x0000000000000000-mapping.dmp
-
memory/3884-140-0x0000000000000000-mapping.dmp