Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:44
Behavioral task
behavioral1
Sample
35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe
Resource
win10v2004-20220414-en
General
-
Target
35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe
-
Size
103KB
-
MD5
f9c052d2ef0481d097e379ab0ebdcef6
-
SHA1
bb34575bd6f49e5a18c32527cf799d5c0cdb2e74
-
SHA256
35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5
-
SHA512
f1cf9525b47d138ba736649482d71b9c9d5adc0fb73aeead3e5c386f644940a178c4096fc25bb60495bf4a1fe73b573334ea95289a6ddd16d8f9f54822cb6cec
Malware Config
Extracted
njrat
im523
Levkrasov
185.82.217.154:9591
7152dc47d9a6ebd70777913857a0545c
-
reg_key
7152dc47d9a6ebd70777913857a0545c
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WindowsServices.exepid process 1980 WindowsServices.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
WindowsServices.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7152dc47d9a6ebd70777913857a0545c.exe WindowsServices.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7152dc47d9a6ebd70777913857a0545c.exe WindowsServices.exe -
Loads dropped DLL 1 IoCs
Processes:
35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exepid process 1648 35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WindowsServices.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\7152dc47d9a6ebd70777913857a0545c = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .." WindowsServices.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\7152dc47d9a6ebd70777913857a0545c = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .." WindowsServices.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WindowsServices.exepid process 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe 1980 WindowsServices.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WindowsServices.exepid process 1980 WindowsServices.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
WindowsServices.exedescription pid process Token: SeDebugPrivilege 1980 WindowsServices.exe Token: 33 1980 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1980 WindowsServices.exe Token: 33 1980 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1980 WindowsServices.exe Token: 33 1980 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1980 WindowsServices.exe Token: 33 1980 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1980 WindowsServices.exe Token: 33 1980 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1980 WindowsServices.exe Token: 33 1980 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1980 WindowsServices.exe Token: 33 1980 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1980 WindowsServices.exe Token: 33 1980 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1980 WindowsServices.exe Token: 33 1980 WindowsServices.exe Token: SeIncBasePriorityPrivilege 1980 WindowsServices.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exeWindowsServices.exedescription pid process target process PID 1648 wrote to memory of 1980 1648 35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe WindowsServices.exe PID 1648 wrote to memory of 1980 1648 35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe WindowsServices.exe PID 1648 wrote to memory of 1980 1648 35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe WindowsServices.exe PID 1648 wrote to memory of 1980 1648 35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe WindowsServices.exe PID 1980 wrote to memory of 2012 1980 WindowsServices.exe netsh.exe PID 1980 wrote to memory of 2012 1980 WindowsServices.exe netsh.exe PID 1980 wrote to memory of 2012 1980 WindowsServices.exe netsh.exe PID 1980 wrote to memory of 2012 1980 WindowsServices.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe"C:\Users\Admin\AppData\Local\Temp\35ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsServices.exe"C:\Users\Admin\AppData\Roaming\WindowsServices.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\WindowsServices.exe" "WindowsServices.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WindowsServices.exeFilesize
103KB
MD5f9c052d2ef0481d097e379ab0ebdcef6
SHA1bb34575bd6f49e5a18c32527cf799d5c0cdb2e74
SHA25635ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5
SHA512f1cf9525b47d138ba736649482d71b9c9d5adc0fb73aeead3e5c386f644940a178c4096fc25bb60495bf4a1fe73b573334ea95289a6ddd16d8f9f54822cb6cec
-
C:\Users\Admin\AppData\Roaming\WindowsServices.exeFilesize
103KB
MD5f9c052d2ef0481d097e379ab0ebdcef6
SHA1bb34575bd6f49e5a18c32527cf799d5c0cdb2e74
SHA25635ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5
SHA512f1cf9525b47d138ba736649482d71b9c9d5adc0fb73aeead3e5c386f644940a178c4096fc25bb60495bf4a1fe73b573334ea95289a6ddd16d8f9f54822cb6cec
-
\Users\Admin\AppData\Roaming\WindowsServices.exeFilesize
103KB
MD5f9c052d2ef0481d097e379ab0ebdcef6
SHA1bb34575bd6f49e5a18c32527cf799d5c0cdb2e74
SHA25635ad22114a87e95d0a8a6ad3ea3bf12e6c48543d4d4d6b6c0a8ba5aa068cd7b5
SHA512f1cf9525b47d138ba736649482d71b9c9d5adc0fb73aeead3e5c386f644940a178c4096fc25bb60495bf4a1fe73b573334ea95289a6ddd16d8f9f54822cb6cec
-
memory/1648-54-0x00000000755C1000-0x00000000755C3000-memory.dmpFilesize
8KB
-
memory/1648-55-0x0000000074640000-0x0000000074BEB000-memory.dmpFilesize
5.7MB
-
memory/1980-57-0x0000000000000000-mapping.dmp
-
memory/1980-61-0x0000000074640000-0x0000000074BEB000-memory.dmpFilesize
5.7MB
-
memory/2012-62-0x0000000000000000-mapping.dmp